PiUEventApplyAdditionalFilters

unsigned __int8 __fastcall PiUEventApplyAdditionalFilters(__int64 a1, __int64 a2){
  int v2; 
  unsigned __int8 v3; 
  int v6; 
  int v7; 
  int v8; 
  SECURITY_SUBJECT_CONTEXT *v9; 
  int v10; 
  int v12; 
  int v13; 
  int v14; 
  void *v15; 
  void *ClientToken; 
  unsigned __int8 IsServiceSession[4]; 
  ULONG SessionId; 
  struct _GENERIC_MAPPING GenericMapping; 
  v2 = *(_DWORD *)(a1 + 88);
  v3 = 1;
  IsServiceSession[0] = 1;
  v6 = v2 - 1;
  if( !v6 )
  {
LABEL_4:
    v9 = (SECURITY_SUBJECT_CONTEXT *)(a2 + 56);
    goto LABEL_5;
  }
  v7 = v6 - 1;
  if( v7 )
  {
    v8 = v7 - 1;
    if( v8 )
    {
      v12 = v8 - 1;
      if( v12 )
      {
        v13 = v12 - 5;
        if( v13 )
        {
          v14 = v13 - 1;
          if( v14 )
          {
            if( v14 != 1 )
              return v3;
          }
        }
      }
    }
    goto LABEL_4;
  }
  v9 = (SECURITY_SUBJECT_CONTEXT *)(a2 + 56);
LABEL_5:
  PiPnpRtlApplyMandatoryFilters();
  if( v10 >= 0 )
    return IsServiceSession[0];
  if( v10 != -1073741772 )
    return 0;
  v15 = *(void **)(a1 + 48);
  if( !v15
    || (IsServiceSession[0] = 0,
        GenericMapping.GenericWrite = 0x20000,
        GenericMapping.GenericExecute = 0x20000,
        GenericMapping.GenericRead = 131073,
        GenericMapping.GenericAll = 983041,
        PiAuVerifyAccessToObject(1ui64, v15, &GenericMapping, v9, IsServiceSession) < 0)
    || (v3 = IsServiceSession[0]) != 0 )
  {
    if( *(_DWORD *)(a1 + 60) != -1 )
    {
      SessionId = 0;
      ClientToken = v9->ClientToken;
      IsServiceSession[0] = 0;
      if( !ClientToken )
        ClientToken = *(void **)(a2 + 72);
      SeQuerySessionIdTokenEx(ClientToken, (UINT64 *)&SessionId, IsServiceSession);
      if( !IsServiceSession[0] && SessionId != *(_DWORD *)(a1 + 60) )
        return 0;
    }
  }
  return v3;
}

Referenced by: