SepExamineSaclEx
void __fastcall SepExamineSaclEx(
__int64 a1,
__int64 a2,
__int64 a3,
int a4,
__int64 a5,
unsigned int a6,
char a7,
int *a8,
_DWORD *a9,
void *a10,
char a11,
_BYTE *a12,
_BYTE *a13){
_DWORD *v13;
_QWORD **v14;
_BYTE *v16;
__int64 v17;
_BYTE *v19;
int *v20;
char v21;
_WORD *v22;
NTSTATUS v23;
unsigned int v24;
__int64 v25;
char v26;
char v27;
int v28;
bool v29;
bool v30;
unsigned int i;
int v32;
unsigned int v33;
_WORD *v34;
_DWORD *v35;
unsigned int v36;
_BYTE *v37;
unsigned int v38;
char *v39;
unsigned int v40;
unsigned int v41;
_QWORD *v42;
__int64 v43;
__int64 v44;
__int64 v45;
__int64 v46;
unsigned int v47;
unsigned int Size;
char Size_4;
unsigned int v50;
int v51;
unsigned int v52;
unsigned int v53;
_DWORD *v54;
__int64 v55;
unsigned int v56;
v51 = -1;
v13 = 0i64;
v14 = (_QWORD **)a3;
v54 = 0i64;
v16 = a13;
v17 = a2;
Size = 0;
v19 = a12;
*a12 = 0;
*a13 = 0;
if( a1 )
{
v53 = *(unsigned __int16 *)(a1 + 4);
if( v53 )
{
v20 = a8;
v21 = 0;
Size_4 = 0;
if( (a4 & 0x2000000) != 0 )
{
v21 = 0x80;
if( *a8 >= 0 )
v21 = 64;
Size_4 = v21;
}
v22 = (_WORD *)*v14[19];
if( *v22 == *(_WORD *)SeAnonymousLogonSid )
{
v23 = memcmp(v22, SeAnonymousLogonSid, 4i64 * *((unsigned __int8 *)SeAnonymousLogonSid + 1) + 8);
v19 = a12;
v16 = a13;
v14 = (_QWORD **)a3;
v17 = a2;
if( !v23 )
Size = 4 * *((unsigned __int8 *)SeWorldSid + 1) + 8;
}
v24 = 0;
v25 = a1 + 8;
v56 = 0;
v55 = a1 + 8;
while( 1 )
{
if( (*v19 || *v16) && a6 <= 1 )
{
LABEL_91:
if( v13 )
{
AuthzBasepFreeSecurityAttributesList(v13);
ExFreePoolWithTag(v13, 0);
}
return;
}
v26 = *(_BYTE *)(v25 + 1);
if( (v26 & 8) == 0 )
{
v27 = *(_BYTE *)v25;
v52 = -1;
v50 = -1;
switch( v27 )
{
case 2:
if( !SepSidInToken(v14, a10, (PVOID)(v25 + 8), 1u, 0, a11)
&& (!Size || *(_WORD *)SeWorldSid != *(_WORD *)(v25 + 8) || memcmp(SeWorldSid, (PVOID)(v25 + 8), Size)) )
{
goto LABEL_87;
}
v28 = *(_DWORD *)(v25 + 4);
if( !a6 )
{
if( *v20 >= 0 )
{
if( (v26 & 0x40) != 0 )
{
if( (*a9 & v28) == 0 )
{
v29 = v21 == 64;
goto LABEL_75;
}
goto LABEL_76;
}
goto LABEL_87;
}
if( v26 >= 0 )
goto LABEL_87;
if( (v28 & a4) == 0 )
{
v30 = v21 == (char)0x80;
LABEL_80:
if( !v30 )
goto LABEL_87;
}
goto LABEL_81;
}
for( i = 0; i < a6; ++i )
SepSetAuditInfoForObjectType(v26, v28, a4, a5, a6, a7, i, (__int64)a8, (__int64)a9, a12, a13);
v25 = v55;
v19 = a12;
v13 = v54;
v16 = a13;
LABEL_31:
v24 = v56;
break;
case 7:
v32 = *(_DWORD *)(v25 + 4);
v33 = *(_DWORD *)(v25 + 8) & 1;
v34 = (_WORD *)(v25 + ((8i64 * (*(_DWORD *)(v25 + 8) & 2)) | 0xC) + 16i64 * v33);
v35 = (_DWORD *)((v25 + 12) & -(__int64)(v33 != 0));
if( v35 )
{
if( SepSidInToken(v14, a10, v34, 1u, 0, a11)
|| Size && *(_WORD *)SeWorldSid == *v34 && !memcmp(SeWorldSid, v34, Size) )
{
v37 = a12;
if( AuthzBasepObjectInTypeList(v35, a5, a6, &v50) )
v38 = v50;
else
v38 = -1;
LABEL_85:
if( v38 != -1 )
SepSetAuditInfoForObjectType(v26, v32, a4, a5, a6, a7, v38, (__int64)a8, (__int64)a9, v37, a13);
}
}
else if( SepSidInToken(v14, a10, v34, 1u, 0, a11)
|| Size && *(_WORD *)SeWorldSid == *v34 && !memcmp(SeWorldSid, v34, Size) )
{
v36 = 0;
if( a6 )
{
do
SepSetAuditInfoForObjectType(v26, v32, a4, a5, a6, a7, v36++, (__int64)a8, (__int64)a9, a12, a13);
while( v36 < a6 );
v25 = v55;
v19 = a12;
v13 = v54;
goto LABEL_88;
}
}
goto LABEL_87;
case 13:
v32 = *(_DWORD *)(v25 + 4);
v39 = (char *)(v25 + 8);
v40 = 4 * *(unsigned __int8 *)(v25 + 9) + 8;
if( v17 && !v13 )
{
AuthzBasepInitializeResourceClaimsFromSacl(v17, (__int64)&v54);
v19 = a12;
v24 = v56;
v13 = v54;
}
v41 = *(unsigned __int16 *)(v25 + 2) - v40;
if( (int)(v41 - 8) <= 0 )
goto LABEL_89;
v42 = *(_QWORD **)(a3 + 1096);
if( v42 )
v43 = v42[75];
else
v43 = 0i64;
if( v42 )
v44 = v42[73];
else
v44 = 0i64;
if( v42 )
v45 = v42[74];
else
v45 = 0i64;
if( v42 )
v46 = v42[72];
else
v46 = 0i64;
AuthzBasepEvaluateAceCondition(
a3,
*(_QWORD *)(a3 + 776),
(__int64)v13,
v46,
v45,
v44,
v43,
&v39[v40],
v41 - 8,
1,
0,
&v51);
if( v51 != 1
|| !SepSidInToken((PVOID)a3, a10, (PVOID)(v25 + 8), 1u, 0, a11)
&& (!Size || *(_WORD *)SeWorldSid != *(_WORD *)v39 || memcmp(SeWorldSid, (PVOID)(v25 + 8), Size)) )
{
goto LABEL_87;
}
if( a6 )
{
v47 = 0;
v37 = a12;
do
SepSetAuditInfoForObjectType(v26, v32, a4, a5, a6, a7, v47++, (__int64)a8, (__int64)a9, a12, a13);
while( v47 < a6 );
v38 = v52;
v25 = v55;
v13 = v54;
goto LABEL_85;
}
if( *a8 >= 0 )
{
if( (v26 & 0x40) != 0 )
{
if( (*a9 & v32) != 0 )
goto LABEL_76;
v29 = Size_4 == 64;
LABEL_75:
if( v29 )
{
LABEL_76:
v19 = a12;
*a12 = 1;
LABEL_88:
v24 = v56;
LABEL_89:
v16 = a13;
break;
}
}
LABEL_87:
v19 = a12;
goto LABEL_88;
}
if( v26 >= 0 )
goto LABEL_87;
if( (v32 & a4) == 0 )
{
v30 = Size_4 == (char)0x80;
goto LABEL_80;
}
LABEL_81:
v16 = a13;
v19 = a12;
*a13 = 1;
goto LABEL_31;
}
}
++v24;
v21 = Size_4;
v25 += *(unsigned __int16 *)(v25 + 2);
v20 = a8;
v14 = (_QWORD **)a3;
v17 = a2;
v56 = v24;
v55 = v25;
if( v24 >= v53 )
goto LABEL_91;
}
}
}
}Referenced by:
SepAccessCheckAndAuditAlarmWithAdminlessChecks
SepExamineGlobalSaclEx