PiAuCheckClientInteractive
INT64 __stdcall PiAuCheckClientInteractive(UINT8 ClientInteractive){
UINT8 *v1;
VOID *PoolWithTag;
UINT64 v3;
void *v4;
int v5;
int v6;
UINT8 IsMember;
struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
*(_DWORD *)IdentifierAuthority.Value = 0;
v1 = (UINT8 *)ClientInteractive;
*(_BYTE *)ClientInteractive = 0;
*(_WORD *)&IdentifierAuthority.Value[4] = 1280;
IsMember = 0;
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0xCui64, 0x20207050ui64);
v4 = PoolWithTag;
if( PoolWithTag )
{
LOBYTE(v3) = 1;
v5 = RtlInitializeSid(PoolWithTag, &IdentifierAuthority, v3);
if( v5 >= 0 )
{
*RtlSubAuthoritySid(v4, 0i64) = 4;
if( !RtlValidSid(v4) )
v5 = -1073741595;
if( v5 >= 0 )
{
PiAuCheckTokenMembership(v4, &IsMember);
v5 = v6;
if( v6 >= 0 )
*v1 = IsMember;
}
}
ExFreePoolWithTag(v4, 0);
}
else
{
return(unsigned int)-1073741670;
}
return(unsigned int)v5;
}Referenced by:
PiCMQueryRemove