SepExamineSaclEx

void __fastcall SepExamineSaclEx(
        __int64 a1,
        __int64 a2,
        __int64 a3,
        int a4,
        __int64 a5,
        unsigned int a6,
        char a7,
        int *a8,
        _DWORD *a9,
        void *a10,
        char a11,
        _BYTE *a12,
        _BYTE *a13){
  _DWORD *v13; 
  _QWORD **v14; 
  _BYTE *v16; 
  __int64 v17; 
  _BYTE *v19; 
  int *v20; 
  char v21; 
  _WORD *v22; 
  NTSTATUS v23; 
  unsigned int v24; 
  __int64 v25; 
  char v26; 
  char v27; 
  int v28; 
  bool v29; 
  bool v30; 
  unsigned int i; 
  int v32; 
  unsigned int v33; 
  _WORD *v34; 
  _DWORD *v35; 
  unsigned int v36; 
  _BYTE *v37; 
  unsigned int v38; 
  char *v39; 
  unsigned int v40; 
  unsigned int v41; 
  _QWORD *v42; 
  __int64 v43; 
  __int64 v44; 
  __int64 v45; 
  __int64 v46; 
  unsigned int v47; 
  unsigned int Size; 
  char Size_4; 
  unsigned int v50; 
  int v51; 
  unsigned int v52; 
  unsigned int v53; 
  _DWORD *v54; 
  __int64 v55; 
  unsigned int v56; 
  v51 = -1;
  v13 = 0i64;
  v14 = (_QWORD **)a3;
  v54 = 0i64;
  v16 = a13;
  v17 = a2;
  Size = 0;
  v19 = a12;
  *a12 = 0;
  *a13 = 0;
  if( a1 )
  {
    v53 = *(unsigned __int16 *)(a1 + 4);
    if( v53 )
    {
      v20 = a8;
      v21 = 0;
      Size_4 = 0;
      if( (a4 & 0x2000000) != 0 )
      {
        v21 = 0x80;
        if( *a8 >= 0 )
          v21 = 64;
        Size_4 = v21;
      }
      v22 = (_WORD *)*v14[19];
      if( *v22 == *(_WORD *)SeAnonymousLogonSid )
      {
        v23 = memcmp(v22, SeAnonymousLogonSid, 4i64 * *((unsigned __int8 *)SeAnonymousLogonSid + 1) + 8);
        v19 = a12;
        v16 = a13;
        v14 = (_QWORD **)a3;
        v17 = a2;
        if( !v23 )
          Size = 4 * *((unsigned __int8 *)SeWorldSid + 1) + 8;
      }
      v24 = 0;
      v25 = a1 + 8;
      v56 = 0;
      v55 = a1 + 8;
      while( 1 )
      {
        if( (*v19 || *v16) && a6 <= 1 )
        {
LABEL_91:
          if( v13 )
          {
            AuthzBasepFreeSecurityAttributesList(v13);
            ExFreePoolWithTag(v13, 0);
          }
          return;
        }
        v26 = *(_BYTE *)(v25 + 1);
        if( (v26 & 8) == 0 )
        {
          v27 = *(_BYTE *)v25;
          v52 = -1;
          v50 = -1;
          switch( v27 )
          {
            case 2:
              if( !SepSidInToken(v14, a10, (PVOID)(v25 + 8), 1u, 0, a11)
                && (!Size || *(_WORD *)SeWorldSid != *(_WORD *)(v25 + 8) || memcmp(SeWorldSid, (PVOID)(v25 + 8), Size)) )
              {
                goto LABEL_87;
              }
              v28 = *(_DWORD *)(v25 + 4);
              if( !a6 )
              {
                if( *v20 >= 0 )
                {
                  if( (v26 & 0x40) != 0 )
                  {
                    if( (*a9 & v28) == 0 )
                    {
                      v29 = v21 == 64;
                      goto LABEL_75;
                    }
                    goto LABEL_76;
                  }
                  goto LABEL_87;
                }
                if( v26 >= 0 )
                  goto LABEL_87;
                if( (v28 & a4) == 0 )
                {
                  v30 = v21 == (char)0x80;
LABEL_80:
                  if( !v30 )
                    goto LABEL_87;
                }
                goto LABEL_81;
              }
              for( i = 0; i < a6; ++i )
                SepSetAuditInfoForObjectType(v26, v28, a4, a5, a6, a7, i, (__int64)a8, (__int64)a9, a12, a13);
              v25 = v55;
              v19 = a12;
              v13 = v54;
              v16 = a13;
LABEL_31:
              v24 = v56;
              break;
            case 7:
              v32 = *(_DWORD *)(v25 + 4);
              v33 = *(_DWORD *)(v25 + 8) & 1;
              v34 = (_WORD *)(v25 + ((8i64 * (*(_DWORD *)(v25 + 8) & 2)) | 0xC) + 16i64 * v33);
              v35 = (_DWORD *)((v25 + 12) & -(__int64)(v33 != 0));
              if( v35 )
              {
                if( SepSidInToken(v14, a10, v34, 1u, 0, a11)
                  || Size && *(_WORD *)SeWorldSid == *v34 && !memcmp(SeWorldSid, v34, Size) )
                {
                  v37 = a12;
                  if( AuthzBasepObjectInTypeList(v35, a5, a6, &v50) )
                    v38 = v50;
                  else
                    v38 = -1;
LABEL_85:
                  if( v38 != -1 )
                    SepSetAuditInfoForObjectType(v26, v32, a4, a5, a6, a7, v38, (__int64)a8, (__int64)a9, v37, a13);
                }
              }
              else if( SepSidInToken(v14, a10, v34, 1u, 0, a11)
                     || Size && *(_WORD *)SeWorldSid == *v34 && !memcmp(SeWorldSid, v34, Size) )
              {
                v36 = 0;
                if( a6 )
                {
                  do
                    SepSetAuditInfoForObjectType(v26, v32, a4, a5, a6, a7, v36++, (__int64)a8, (__int64)a9, a12, a13);
                  while( v36 < a6 );
                  v25 = v55;
                  v19 = a12;
                  v13 = v54;
                  goto LABEL_88;
                }
              }
              goto LABEL_87;
            case 13:
              v32 = *(_DWORD *)(v25 + 4);
              v39 = (char *)(v25 + 8);
              v40 = 4 * *(unsigned __int8 *)(v25 + 9) + 8;
              if( v17 && !v13 )
              {
                AuthzBasepInitializeResourceClaimsFromSacl(v17, (__int64)&v54);
                v19 = a12;
                v24 = v56;
                v13 = v54;
              }
              v41 = *(unsigned __int16 *)(v25 + 2) - v40;
              if( (int)(v41 - 8) <= 0 )
                goto LABEL_89;
              v42 = *(_QWORD **)(a3 + 1096);
              if( v42 )
                v43 = v42[75];
              else
                v43 = 0i64;
              if( v42 )
                v44 = v42[73];
              else
                v44 = 0i64;
              if( v42 )
                v45 = v42[74];
              else
                v45 = 0i64;
              if( v42 )
                v46 = v42[72];
              else
                v46 = 0i64;
              AuthzBasepEvaluateAceCondition(
                a3,
                *(_QWORD *)(a3 + 776),
                (__int64)v13,
                v46,
                v45,
                v44,
                v43,
                &v39[v40],
                v41 - 8,
                1,
                0,
                &v51);
              if( v51 != 1
                || !SepSidInToken((PVOID)a3, a10, (PVOID)(v25 + 8), 1u, 0, a11)
                && (!Size || *(_WORD *)SeWorldSid != *(_WORD *)v39 || memcmp(SeWorldSid, (PVOID)(v25 + 8), Size)) )
              {
                goto LABEL_87;
              }
              if( a6 )
              {
                v47 = 0;
                v37 = a12;
                do
                  SepSetAuditInfoForObjectType(v26, v32, a4, a5, a6, a7, v47++, (__int64)a8, (__int64)a9, a12, a13);
                while( v47 < a6 );
                v38 = v52;
                v25 = v55;
                v13 = v54;
                goto LABEL_85;
              }
              if( *a8 >= 0 )
              {
                if( (v26 & 0x40) != 0 )
                {
                  if( (*a9 & v32) != 0 )
                    goto LABEL_76;
                  v29 = Size_4 == 64;
LABEL_75:
                  if( v29 )
                  {
LABEL_76:
                    v19 = a12;
                    *a12 = 1;
LABEL_88:
                    v24 = v56;
LABEL_89:
                    v16 = a13;
                    break;
                  }
                }
LABEL_87:
                v19 = a12;
                goto LABEL_88;
              }
              if( v26 >= 0 )
                goto LABEL_87;
              if( (v32 & a4) == 0 )
              {
                v30 = Size_4 == (char)0x80;
                goto LABEL_80;
              }
LABEL_81:
              v16 = a13;
              v19 = a12;
              *a13 = 1;
              goto LABEL_31;
          }
        }
        ++v24;
        v21 = Size_4;
        v25 += *(unsigned __int16 *)(v25 + 2);
        v20 = a8;
        v14 = (_QWORD **)a3;
        v17 = a2;
        v56 = v24;
        v55 = v25;
        if( v24 >= v53 )
          goto LABEL_91;
      }
    }
  }
}

Referenced by:

SepAccessCheckAndAuditAlarmWithAdminlessChecks
SepExamineGlobalSaclEx