SeExamineSacl

VOID __stdcall SeExamineSacl(
        PACL Sacl,
        PACL ResourceSacl,
        PACCESS_TOKEN Token,
        ACCESS_MASK DesiredAccess,
        BOOLEAN AccessGranted,
        PBOOLEAN GenerateAudit,
        PBOOLEAN GenerateAlarm){
  _DWORD *v7; 
  PBOOLEAN v8; 
  unsigned int v9; 
  _QWORD **v10; 
  PBOOLEAN v11; 
  PACL v12; 
  unsigned int AceCount; 
  BOOLEAN v15; 
  char v16; 
  _WORD *v17; 
  NTSTATUS v18; 
  unsigned int v19; 
  PACL v20; 
  char Sbz1; 
  struct _ACL *v22; 
  unsigned int v23; 
  int v24; 
  unsigned int v25; 
  _QWORD *v26; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  __int64 v30; 
  int v31; 
  unsigned int v32; 
  __int64 v33[10]; 
  int v34; 
  PACL v35; 
  PVOID Tokena; 
  ACCESS_MASK v37; 
  v37 = DesiredAccess;
  Tokena = Token;
  v35 = ResourceSacl;
  v34 = -1;
  v7 = 0i64;
  v8 = GenerateAudit;
  v9 = 0;
  v33[0] = 0i64;
  v10 = (_QWORD **)Token;
  v11 = GenerateAlarm;
  v12 = ResourceSacl;
  *GenerateAudit = 0;
  *v11 = 0;
  if( Sacl )
  {
    AceCount = Sacl->AceCount;
    v32 = AceCount;
    if( Sacl->AceCount )
    {
      v15 = AccessGranted;
      v16 = 0;
      if( (DesiredAccess & 0x2000000) != 0 )
        v16 = AccessGranted != 0 ? 64 : 0x80;
      v17 = (_WORD *)*v10[19];
      if( *v17 == *(_WORD *)SeAnonymousLogonSid )
      {
        v18 = memcmp(v17, SeAnonymousLogonSid, 4i64 * *((unsigned __int8 *)SeAnonymousLogonSid + 1) + 8);
        v10 = (_QWORD **)Tokena;
        v12 = v35;
        if( !v18 )
          v9 = 4 * *((unsigned __int8 *)SeWorldSid + 1) + 8;
      }
      v19 = 0;
      v20 = Sacl + 1;
      LODWORD(GenerateAudit) = 0;
      if( AceCount )
      {
        while( 1 )
        {
          if( *v8 )
          {
LABEL_51:
            if( v7 )
            {
              AuthzBasepFreeSecurityAttributesList(v7);
              ExFreePoolWithTag(v7, 0);
            }
            return;
          }
          Sbz1 = v20->Sbz1;
          if( (Sbz1 & 8) == 0 )
            break;
LABEL_50:
          ++v19;
          v10 = (_QWORD **)Tokena;
          v20 = (PACL)((char *)v20 + v20->AclSize);
          v12 = v35;
          LODWORD(GenerateAudit) = v19;
          if( v19 >= v32 )
            goto LABEL_51;
        }
        if( v20->AclRevision == 2 )
        {
          if( !SepSidInToken(v10, 0i64, &v20[1], 1u, 0, 0)
            && (!v9 || *(_WORD *)SeWorldSid != *(_WORD *)&v20[1].AclRevision || memcmp(SeWorldSid, &v20[1], v9)) )
          {
            goto LABEL_49;
          }
          if( (*(_DWORD *)&v20->AceCount & v37) == 0 )
          {
            v19 = (unsigned int)GenerateAudit;
            if( ((unsigned __int8)v16 & (unsigned __int8)Sbz1) != 0 )
              *v8 = 1;
            goto LABEL_50;
          }
        }
        else
        {
          if( v20->AclRevision != 13 )
            goto LABEL_50;
          v22 = v20 + 1;
          v23 = 4 * v20[1].Sbz1 + 8;
          v24 = *(_DWORD *)&v20->AceCount;
          LODWORD(GenerateAlarm) = v23;
          v31 = v24;
          if( v12 && !v7 )
          {
            AuthzBasepInitializeResourceClaimsFromSacl((__int64)v12, (__int64)v33);
            v23 = (unsigned int)GenerateAlarm;
            v19 = (unsigned int)GenerateAudit;
            v7 = (_DWORD *)v33[0];
          }
          v25 = v20->AclSize - v23;
          if( (int)(v25 - 8) <= 0 )
            goto LABEL_50;
          v26 = (_QWORD *)*((_QWORD *)Tokena + 137);
          if( v26 )
            v27 = v26[75];
          else
            v27 = 0i64;
          if( v26 )
            v28 = v26[73];
          else
            v28 = 0i64;
          if( v26 )
            v29 = v26[74];
          else
            v29 = 0i64;
          if( v26 )
            v30 = v26[72];
          else
            v30 = 0i64;
          AuthzBasepEvaluateAceCondition(
            (__int64)Tokena,
            *((_QWORD *)Tokena + 97),
            (__int64)v7,
            v30,
            v29,
            v28,
            v27,
            (char *)v22 + v23,
            v25 - 8,
            1,
            0,
            &v34);
          if( ((v34 + 1) & 0xFFFFFFFD) != 0
            || !SepSidInToken(Tokena, 0i64, &v20[1], 1u, 0, 0)
            && (!v9 || *(_WORD *)SeWorldSid != *(_WORD *)&v22->AclRevision || memcmp(SeWorldSid, &v20[1], v9)) )
          {
            goto LABEL_49;
          }
          if( (v37 & v31) == 0 )
          {
            if( ((unsigned __int8)v16 & (unsigned __int8)Sbz1) == 0 )
            {
LABEL_49:
              v19 = (unsigned int)GenerateAudit;
              goto LABEL_50;
            }
LABEL_48:
            *v8 = 1;
            goto LABEL_49;
          }
        }
        if( ((Sbz1 & 0x40) == 0 || !v15) && (Sbz1 >= 0 || v15) )
          goto LABEL_49;
        goto LABEL_48;
      }
    }
  }
}

Referenced by: