ObpVerifyCreatorAccessCheck

__int64 __fastcall ObpVerifyCreatorAccessCheck(_DWORD *a1){
  _ETHREAD *CurrentThread; 
  _DWORD *PrimaryToken; 
  _DWORD *v4; 
  int v5; 
  int v6; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  VOID *TokenInformation; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  PVOID P[2]; 
  __int64 v12; 
  char Sid[80]; 

  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_WORD *)&IdentifierAuthority.Value[4] = 4096;
  memset(Sid, 0i64, 0x44u);
  TokenInformation = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v12 = 0i64;
  *(_OWORD *)P = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  SeCaptureSubjectContextEx(CurrentThread, CurrentThread->Tcb.ApcState.Process, &SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  if( PrimaryToken[48] == 2 && (int)PrimaryToken[49] < 2 )
    goto LABEL_14;
  SeQueryInformationToken(PrimaryToken, TokenIsAppContainer, &TokenInformation);
  if( !(_DWORD)TokenInformation
    || (LODWORD(v12) = SeQueryInformationToken(PrimaryToken, TokenAppContainerSid, P), (int)v12 >= 0) )
  {
    SeQueryInformationToken(PrimaryToken, TokenIntegrityLevel, (VOID **)((char *)&TokenInformation + 4));
    RtlInitializeSid(Sid, &IdentifierAuthority, 1u);
    LODWORD(v4) = RtlSubAuthoritySid((INT64)Sid, 0i64);
    *v4 = HIDWORD(TokenInformation);
    P[1] = Sid;
    SeLockSubjectContext(&SubjectContext);
    v5 = RtlEnumerateBoundaryDescriptorEntries(
           a1,
           (unsigned int(__fastcall *)(_DWORD *, __int64))ObpVerifyAccessToBoundaryEntry,
           (__int64)&SubjectContext);
    SeUnlockSubjectContext(&SubjectContext);
    v6 = v12;
    if( (int)v12 >= 0 )
    {
      if( v5 < 0 )
        v6 = v5;
      LODWORD(v12) = v6;
      if( v6 >= 0 && P[0] && (v12 & 0x100000000i64) == 0 )
LABEL_14:
        LODWORD(v12) = -1073741790;
    }
  }
  SeReleaseSubjectContext(&SubjectContext);
  if( P[0] )
    ExFreePoolWithTag(P[0], 0);
  return(unsigned int)v12;
}

Referenced by: