PiAuCheckClientInteractive

INT64 __stdcall PiAuCheckClientInteractive(UINT8 ClientInteractive){
  UINT8 *v1; 
  VOID *PoolWithTag; 
  UINT64 v3; 
  void *v4; 
  int v5; 
  int v6; 
  UINT8 IsMember; 
  struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  *(_DWORD *)IdentifierAuthority.Value = 0;
  v1 = (UINT8 *)ClientInteractive;
  *(_BYTE *)ClientInteractive = 0;
  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  IsMember = 0;
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0xCui64, 0x20207050ui64);
  v4 = PoolWithTag;
  if( PoolWithTag )
  {
    LOBYTE(v3) = 1;
    v5 = RtlInitializeSid(PoolWithTag, &IdentifierAuthority, v3);
    if( v5 >= 0 )
    {
      *RtlSubAuthoritySid(v4, 0i64) = 4;
      if( !RtlValidSid(v4) )
        v5 = -1073741595;
      if( v5 >= 0 )
      {
        PiAuCheckTokenMembership(v4, &IsMember);
        v5 = v6;
        if( v6 >= 0 )
          *v1 = IsMember;
      }
    }
    ExFreePoolWithTag(v4, 0);
  }
  else
  {
    return(unsigned int)-1073741670;
  }
  return(unsigned int)v5;
}

Referenced by:

PiCMQueryRemove