SepTrustLevelCheck

INT64 __fastcall SepTrustLevelCheck(
        INT64 a1,
        VOID *a2,
        SECURITY_SUBJECT_CONTEXT *a3,
        INT64 a4,
        VOID *Sid1,
        CHAR a6,
        INT64 *a7){
  char v9; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *TrustLabelAce; 
  BOOL v11; 
  INT64 result; 
  ACCESS_MASK Mask; 
  ULONG *p_SidStart; 
  _ETHREAD *CurrentThread; 
  void *v16; 
  NTSTATUS v17; 
  char v18[40]; 
  INT64 pbDominate; 
  pbDominate = a1;
  v18[0] = 0;
  LOBYTE(pbDominate) = 0;
  v9 = 0;
  TrustLabelAce = SeGetTrustLabelAce(a2);
  if( !TrustLabelAce
    || (Mask = TrustLabelAce->Mask,
        p_SidStart = &TrustLabelAce->SidStart,
        TrustLabelAce == (_SYSTEM_PROCESS_TRUST_LABEL_ACE *)-8i64) )
  {
    result = 0i64;
    *(_DWORD *)a7 = -1;
    return result;
  }
  if( a6 )
  {
    if( a4 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      LOBYTE(v11) = 1;
      ExAcquireResourceSharedLite(*(PERESOURCE *)(a4 + 48), v11);
    }
    else
    {
      SeLockSubjectContext(a3);
    }
    v9 = 1;
  }
  if( a4 )
  {
    v16 = Sid1;
    goto LABEL_15;
  }
  if( !a3->ClientToken )
  {
LABEL_14:
    v16 = (void *)*((_QWORD *)a3->PrimaryToken + 138);
LABEL_15:
    v17 = RtlSidDominatesForTrust(v16, p_SidStart, (UINT8 *)v18);
    if( v17 >= 0 )
    {
      if( v18[0] )
        *(_DWORD *)a7 = -1;
      else
        *(_DWORD *)a7 = Mask | 0x1000000;
    }
    goto LABEL_19;
  }
  v17 = RtlSidDominatesForTrust(
          *((PVOID *)a3->PrimaryToken + 138),
          *((PVOID *)a3->ClientToken + 138),
          (UINT8 *)&pbDominate);
  if( v17 >= 0 )
  {
    if( (_BYTE)pbDominate )
      goto LABEL_15;
    goto LABEL_14;
  }
LABEL_19:
  if( v9 )
  {
    if( a4 )
    {
      ExReleaseResourceLite(*(PERESOURCE *)(a4 + 48));
      KeLeaveCriticalRegion();
    }
    else
    {
      SeUnlockSubjectContext(a3);
    }
  }
  return(unsigned int)v17;
}

Referenced by: