NTSTATUS __stdcall SepAccessCheckAndAuditAlarmWithAdminlessChecks(
PFN_WDFCX_DEVICE_POST_SELF_MANAGED_IO_INIT *a1,
INT64 rdx0,
_XSTATE_FEATURE **a3,
PFN_WDFCX_DEVICE_POST_SELF_MANAGED_IO_INIT *a4,
INT64 a5,
_XSTATE_FEATURE *InputSecurityDescriptor,
INT64 a7,
_XSTATE_CONFIGURATION *RemainingDesiredAccess,
INT64 a9,
CHAR a10,
INT64 a11,
INT64 a12,
INT64 a13,
INT64 a14,
INT64 a15,
INT64 a16,
CHAR a17,
CHAR a18){
INT64 v19;
unsigned __int64 v20;
int *v21;
char *v22;
unsigned __int8 v23;
PVOID v24;
__int64 v25;
UINT64 v26;
NTSTATUS v27;
INT64 v28;
INT64 v29;
INT64 v30;
__int16 v31;
__int64 v32;
INT64 v33;
__int64 v34;
INT64 v35;
__int64 v36;
INT64 v37;
INT64 v38;
char v39;
_SECURITY_DESCRIPTOR *v40;
unsigned int v41;
NTSTATUS v42;
int v43;
UINT8 v44;
UINT8 IsOwner;
CHAR ReturnResultList;
VOID **GrantedAccess;
INT64 *AccessStatus;
__int64 v49;
int v50;
CHAR v51;
CHAR *v52;
int v53;
UINT8 v54;
char v55;
UINT64 *v56;
int v57;
CHAR v58;
char v59;
_DWORD *v60;
_DWORD *v61;
unsigned int v62;
int v63;
char *v64;
UINT64 v65;
char v66;
int *v67;
_DWORD *v68;
_DWORD *v69;
UINT64 v70;
__int64 v71;
__int16 v73;
__int64 v74;
_ACL *v75;
int v76;
int v77;
int v78;
int v79;
int v80;
int v81;
UINT8 v82;
UINT8 v83;
_XSTATE_FEATURE *v84;
int v85;
VOID **PoolWithTag;
unsigned int v87;
unsigned int v88;
__int64 v89;
__int16 v90;
__int64 v91;
_ACL *v92;
VOID *ScopedPolicySid;
NTSTATUS Cap;
_RTL_DYNAMIC_HASH_TABLE_ENTRY *v95;
VOID **v96;
unsigned int v97;
unsigned int v98;
__int64 v99;
VOID **v100;
INT64 *v101;
unsigned int v102;
__int64 v103;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v104;
_QWORD *v105;
VOID *v106;
VOID *v107;
VOID *v108;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v109;
NTSTATUS v110;
int v111;
_QWORD *v112;
VOID *v113;
VOID *v114;
VOID *v115;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v116;
int v117;
int v118;
_IOBJECT_TYPE_LIST *v119;
int v120;
int v121;
int v122;
int v123;
unsigned int v124;
unsigned int v125;
__int64 v126;
_ETHREAD *CurrentThread;
VOID *TokenTrustLevel;
VOID *v129;
__int16 v130;
_ACL *v131;
__int64 v132;
_ACL *v133;
__int64 v134;
unsigned int v135;
CHAR v136;
VOID *v137;
__int16 v138;
_ACL *v139;
__int64 v140;
int v141;
__int64 v142;
PVOID *p_HandleId;
__int64 v144;
PVOID *v145;
_LIST_ENTRY *Blink;
VOID **OutputSecurityDescriptor;
VOID **OutputSecurityDescriptora;
VOID **OutputSecurityDescriptorb;
VOID **OutputSecurityDescriptorc;
VOID **OutputSecurityDescriptord;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfo;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfoa;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfob;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfoc;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfod;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfoe;
INT64 v158;
INT64 v159;
INT64 v160;
INT64 v161;
_SEP_MANDATORY_INFORMATION *p_MandatoryInformation;
UINT64 v163;
UINT8 v164;
INT64 DesiredAccess;
UINT64 DesiredAccessa;
UINT64 ConditionSize;
UINT64 ConditionSizea;
INT8 PreviousMode;
UINT8 ReturnSomeAccessGranted;
UINT8 TokenIsOwner;
UINT8 ReturnSomeAccessDenied;
UINT8 v173;
char v174;
char v175;
UINT8 v176;
NTSTATUS v177;
UINT64 ObjectTypeListLength;
PVOID v179;
UINT8 GenerateFailureAudit;
char v181;
char v182;
int v183;
_BYTE v184[3];
unsigned __int8 v185;
INT64 v186;
PVOID v187;
UINT16 FlatSubCategoryId[2];
UINT64 PreviouslyGrantedAccess;
char v190;
UINT8 v191;
UINT8 v192;
char v193;
char v194;
char v195;
char v196;
int v197;
int v198;
int v199;
int v200;
unsigned int v201;
char Result[36];
unsigned int v203;
_IOBJECT_TYPE_LIST *CapturedObjectTypeList;
INT64 ResourceInfo;
INT64 *v206;
_UNICODE_STRING *ObjectTypeName;
UINT64 v208;
VOID *PrincipalSelfSid;
VOID *Src;
INT64 v211;
_ACL *pSacl;
_RTL_DYNAMIC_HASH_TABLE_ENTRY *a2;
VOID *Address;
PRIVILEGE_SET *PrivilegeSet;
int v216;
_UNICODE_STRING *DestString;
PVOID P;
INT64 v219;
PFN_WDFCX_DEVICE_POST_SELF_MANAGED_IO_INIT *v220;
_BYTE *v221;
int v222;
int v223;
INT64 HandleId;
PADAPTER_OBJECT DmaAdapter;
_IOBJECT_TYPE_LIST *NewObjectTypeList;
_OBJECT_TYPE_LIST *ObjectTypeList;
PVOID Object;
_UNICODE_STRING *SourceString;
_UNICODE_STRING *v230;
_UNICODE_STRING *v231;
PVOID v232;
_SEP_MANDATORY_INFORMATION MandatoryInformation;
_XSTATE_FEATURE **v234;
PFN_WDFCX_DEVICE_POST_SELF_MANAGED_IO_INIT *v235;
_XSTATE_FEATURE *v236;
__int128 CapeSecurityDescriptor[2];
__int64 v238;
__int128 PackageCapabilityInfo;
__int64 v240;
int v241;
_GENERIC_MAPPING GenericMapping;
v230 = (_UNICODE_STRING *)a4;
SourceString = (_UNICODE_STRING *)a1;
v220 = a1;
HandleId = rdx0;
v234 = a3;
v235 = a4;
v231 = (_UNICODE_STRING *)a5;
v236 = InputSecurityDescriptor;
Src = (VOID *)a7;
ObjectTypeList = (_OBJECT_TYPE_LIST *)a11;
LODWORD(ObjectTypeListLength) = a12;
v19 = a13;
v208 = a14;
v20 = a15;
Address = (VOID *)a15;
v221 = (_BYTE *)a16;
v21 = 0i64;
v177 = 0;
v22 = 0i64;
v179 = 0i64;
v181 = 0;
v183 = -1073741823;
v222 = 0;
v187 = 0i64;
v223 = 0;
v206 = 0i64;
v200 = 0;
v197 = 0;
v196 = 0;
DestString = 0i64;
ObjectTypeName = 0i64;
P = 0i64;
v186 = 0i64;
PrincipalSelfSid = 0i64;
CapturedObjectTypeList = 0i64;
PreviouslyGrantedAccess = 0i64;
GenericMapping = 0i64;
PrivilegeSet = 0i64;
ReturnSomeAccessGranted = 0;
ReturnSomeAccessDenied = 0;
GenerateFailureAudit = 0;
v193 = 0;
v176 = 0;
v173 = 0;
v191 = 1;
v192 = 0;
DmaAdapter = 0i64;
v232 = 0i64;
v194 = 0;
MandatoryInformation = 0i64;
pSacl = 0i64;
memset(CapeSecurityDescriptor, 0, sizeof(CapeSecurityDescriptor));
v238 = 0i64;
a2 = 0i64;
v182 = 0;
v175 = 0;
TokenIsOwner = 0;
v195 = 0;
FlatSubCategoryId[0] = 999;
PackageCapabilityInfo = 0i64;
v240 = 0i64;
v241 = 0;
v174 = 0;
v199 = 0;
ResourceInfo = 0i64;
memset(Result, 0, sizeof(Result));
v198 = 0;
v190 = 0;
memset(v184, 0, sizeof(v184));
NewObjectTypeList = 0i64;
LODWORD(v211) = -1;
v219 = 0xFFFFFFFFi64;
v23 = KeGetCurrentThread()->$87BC921A506A176A34DE473FC146A343::gap0[10];
PreviousMode = v23;
v185 = v23;
SeCaptureSubjectContext((INT64)&Result[4]);
if( (_DWORD)a9 )
{
if( (_DWORD)a9 != 1 )
{
v27 = -1073741811;
goto LABEL_371;
}
v216 = 7;
}
else
{
v216 = 2;
}
v24 = *(PVOID *)&Result[4];
if( !a3 )
{
if( *(_QWORD *)&Result[4] )
{
if( *(int *)&Result[12] >= 1 )
goto LABEL_6;
v27 = -1073741659;
v22 = 0i64;
}
else
{
v27 = -1073741732;
v22 = 0i64;
}
LABEL_371:
v30 = v186;
goto LABEL_116;
}
LABEL_6:
if( a17 )
{
if( !(_DWORD)ObjectTypeListLength || (unsigned int)ObjectTypeListLength > 0x1000 )
{
v27 = -1073741811;
v177 = -1073741811;
goto LABEL_19;
}
ProbeForWrite((UINT64)Address, 4i64 * (unsigned int)ObjectTypeListLength, 4i64);
ProbeForWrite(v208, 4i64 * (unsigned int)ObjectTypeListLength, 4i64);
}
else
{
v25 = v20;
if( v20 >= 0x7FFFFFFF0000i64 )
v25 = 0x7FFFFFFF0000i64;
*(_DWORD *)v25 = *(_DWORD *)v25;
v26 = v208;
if( v208 >= 0x7FFFFFFF0000i64 )
v26 = 0x7FFFFFFF0000i64;
*(_DWORD *)v26 = *(_DWORD *)v26;
}
if( (v19 & 3) != 0 )
ExRaiseDatatypeMisalignment();
GenericMapping = *(_GENERIC_MAPPING *)v19;
v24 = *(PVOID *)&Result[4];
v27 = v177;
LABEL_19:
if( v27 < 0 )
goto LABEL_187;
if( !a3 )
{
LABEL_21:
if( !v24 )
v24 = *(PVOID *)&Result[20];
v220 = (PFN_WDFCX_DEVICE_POST_SELF_MANAGED_IO_INIT *)v24;
if( SeCheckAuditPrivilege((_SECURITY_SUBJECT_CONTEXT *)&Result[4], v23) )
{
LABEL_24:
if( ((unsigned int)RemainingDesiredAccess & 0xF0000000) != 0 )
{
v27 = -1073741594;
v22 = (char *)v179;
v21 = (int *)v179;
goto LABEL_371;
}
v27 = SeCaptureSecurityDescriptor(
InputSecurityDescriptor,
v23,
PagedPool,
0,
(VOID **)&v186,
(INT64)TrustCheckInfo,
v158);
v177 = v27;
if( v27 < 0 )
{
v30 = 0i64;
goto LABEL_190;
}
v30 = v186;
if( v186 )
{
v31 = *(_WORD *)(v186 + 2);
if( v31 >= 0 )
{
v33 = *(_QWORD *)(v186 + 8);
}
else
{
v32 = *(unsigned int *)(v186 + 4);
if( !(_DWORD)v32 )
goto LABEL_192;
v33 = v186 + v32;
}
if( v33 )
{
if( v31 >= 0 )
{
v35 = *(_QWORD *)(v186 + 16);
}
else
{
v34 = *(unsigned int *)(v186 + 8);
if( !(_DWORD)v34 )
goto LABEL_192;
v35 = v186 + v34;
}
if( v35 )
{
v36 = (__int64)v221;
if( (unsigned __int64)v221 >= 0x7FFFFFFF0000i64 )
v36 = 0x7FFFFFFF0000i64;
*(_BYTE *)v36 = *(_BYTE *)v36;
v27 = SepProbeAndCaptureString_U(
SourceString,
&DestString,
v28,
v29,
(INT64)OutputSecurityDescriptor,
(INT64)TrustCheckInfoa,
v159,
DesiredAccess);
v177 = v27;
if( v27 >= 0 )
{
v27 = SepProbeAndCaptureString_U(
v230,
&ObjectTypeName,
v37,
v38,
(INT64)OutputSecurityDescriptora,
(INT64)TrustCheckInfob,
v160,
DesiredAccessa);
v177 = v27;
if( v27 >= 0 )
{
v27 = SepProbeAndCaptureString_U(
v231,
(_UNICODE_STRING **)&P,
v37,
v38,
(INT64)OutputSecurityDescriptorb,
(INT64)TrustCheckInfob,
v161,
DesiredAccessa);
v177 = v27;
}
}
v39 = v174;
if( v27 >= 0 )
{
if( Src )
{
v27 = SeCaptureSid(Src, v23, v37, v38);
if( v27 < 0 )
{
PrincipalSelfSid = 0i64;
v22 = (char *)v179;
v21 = (int *)v179;
goto LABEL_371;
}
}
v27 = SeCaptureObjectTypeList(
ObjectTypeList,
(unsigned int)ObjectTypeListLength,
v23,
&CapturedObjectTypeList);
if( v27 >= 0 )
{
LOBYTE(TrustCheckInfob) = 1;
v30 = v186;
v27 = SepTrustLevelCheck(
v40,
(VOID *)v186,
(_TOKEN *)&Result[4],
0i64,
0i64,
TrustCheckInfob,
(_SEP_TRUST_CHECK_INFORMATION *)&v211);
if( v27 < 0 )
{
LABEL_191:
v22 = (char *)v179;
v21 = (int *)v179;
goto LABEL_116;
}
v41 = (unsigned int)RemainingDesiredAccess;
v27 = SepFilterToDiscretionary(&v211, (int)RemainingDesiredAccess);
v177 = v27;
if( v27 < 0 )
{
v184[0] = 1;
LABEL_48:
if( v27 < 0 )
goto LABEL_54;
p_MandatoryInformation = &MandatoryInformation;
LOBYTE(TrustCheckInfoc) = a18;
v27 = SepMandatoryIntegrityCheck(
&GenericMapping,
(_SECURITY_DESCRIPTOR *)v30,
0,
(_TOKEN *)v24,
1u,
(_SEP_MANDATORY_INFORMATION *)TrustCheckInfoc);
if( v27 >= 0 )
{
v42 = SepMandatoryToDiscretionary(&MandatoryInformation, v41);
v27 = v42;
v177 = v42;
if( (v42 < 0 || (v41 & 0x2000000) != 0)
&& (*((_DWORD *)v24 + 50) & 0x4000) != 0
&& MandatoryInformation.ObjectLabel <= 0x2000 )
{
v39 = 1;
v174 = 1;
}
if( v42 >= 0 || v39 )
{
v27 = SePrivilegePolicyCheck(
(UINT64 *)&RemainingDesiredAccess,
&PreviouslyGrantedAccess,
(_SECURITY_SUBJECT_CONTEXT *)&Result[4],
0i64,
&PrivilegeSet,
PreviousMode);
v177 = v27;
v41 = (unsigned int)RemainingDesiredAccess;
if( !(_DWORD)RemainingDesiredAccess )
{
v85 = (unsigned __int8)v198;
v43 = PreviouslyGrantedAccess;
if( (_DWORD)PreviouslyGrantedAccess )
v85 = 1;
v198 = v85;
LABEL_55:
SeLockSubjectContext((PSECURITY_SUBJECT_CONTEXT)&Result[4]);
if( v27 < 0 && !v174 )
{
ReturnSomeAccessDenied = 1;
v183 = v27;
if( !a17 )
{
v179 = (char *)&PreviouslyGrantedAccess + 4;
AccessStatus = (INT64 *)&v183;
goto LABEL_71;
}
PoolWithTag = ExAllocatePoolWithTag(
1ui64,
8i64 * (unsigned int)ObjectTypeListLength,
1632068947i64);
v179 = PoolWithTag;
if( !PoolWithTag )
{
SeUnlockSubjectContext((PSECURITY_SUBJECT_CONTEXT)&Result[4]);
v27 = -1073741670;
v23 = PreviousMode;
v22 = 0i64;
v21 = (int *)v187;
goto LABEL_116;
}
v181 = 1;
AccessStatus = (INT64 *)((char *)PoolWithTag + 4 * (unsigned int)ObjectTypeListLength);
v87 = 0;
v88 = ObjectTypeListLength;
while( v87 < v88 )
{
v89 = 4i64 * v87;
*(_DWORD *)((char *)PoolWithTag + v89) = HIDWORD(PreviouslyGrantedAccess);
*(_DWORD *)((char *)AccessStatus + v89) = v183;
++v87;
}
goto LABEL_210;
}
IsOwner = SepTokenIsOwner(v24, (VOID *)v30, v44);
TokenIsOwner = IsOwner;
v30 = v186;
if( !SepRmEnforceCap )
goto LABEL_57;
v90 = *(_WORD *)(v186 + 2);
if( (v90 & 0x10) == 0 || KeGetCurrentIrql() >= 2u )
goto LABEL_57;
if( v90 >= 0 )
{
v92 = *(_ACL **)(v186 + 24);
}
else
{
v91 = *(unsigned int *)(v186 + 12);
if( !(_DWORD)v91 )
{
pSacl = 0i64;
LABEL_217:
IsOwner = TokenIsOwner;
LABEL_57:
v27 = v177;
goto LABEL_58;
}
v92 = (_ACL *)(v186 + v91);
}
pSacl = v92;
if( v92 )
{
ScopedPolicySid = SepGetScopedPolicySid(v92);
if( ScopedPolicySid )
{
Cap = SepRmReferenceFindCap(ScopedPolicySid, (_SEP_CENTRALIZED_ACCESS_POLICY **)&a2);
v95 = a2;
if( Cap < 0 )
v95 = (_RTL_DYNAMIC_HASH_TABLE_ENTRY *)SepRmDefaultCap;
a2 = v95;
v27 = 0;
v177 = 0;
v182 = 1;
IsOwner = TokenIsOwner;
LABEL_58:
v41 = (unsigned int)RemainingDesiredAccess;
if( ((unsigned int)RemainingDesiredAccess & 0x2060000) != 0
&& IsOwner
&& ((v73 = *(_WORD *)(v30 + 2), (v73 & 4) == 0) ? (v75 = 0i64) : v73 >= 0 ? (v75 = *(_ACL **)(v30 + 32)) : (v74 = *(unsigned int *)(v30 + 16), !(_DWORD)v74) ? (v75 = 0i64) : (v75 = (_ACL *)(v30 + v74)),
!RtlOwnerAcesPresent(v75)) )
{
if( (v41 & 0x2000000) != 0 )
{
v76 = 393216;
v43 = PreviouslyGrantedAccess | 0x60000;
}
else
{
v76 = v41 & 0x60000;
v43 = PreviouslyGrantedAccess | v41 & 0x60000;
}
v199 = v76;
LODWORD(PreviouslyGrantedAccess) = v43;
v41 &= 0xFFF9FFFF;
LODWORD(RemainingDesiredAccess) = v41;
}
else
{
v43 = PreviouslyGrantedAccess;
}
if( !v41 && (!v182 || (_BYTE)v198) && ((*((_DWORD *)v24 + 50) & 0x2000) != 0 || !v199) )
{
HIDWORD(PreviouslyGrantedAccess) = v43;
if( v43 )
{
v81 = 0;
v82 = 0;
v83 = 1;
}
else
{
v81 = -1073741790;
v82 = 1;
v83 = 0;
}
ReturnSomeAccessGranted = v83;
ReturnSomeAccessDenied = v82;
v183 = v81;
if( !a17 )
{
v179 = (char *)&PreviouslyGrantedAccess + 4;
AccessStatus = (INT64 *)&v183;
LABEL_71:
if( !v24 )
goto LABEL_77;
if( *(_WORD *)v184 )
goto LABEL_320;
if( !HIDWORD(PackageCapabilityInfo) && (*((_DWORD *)v24 + 50) & 0x4000) != 0 )
{
if( v27 < 0 )
goto LABEL_77;
if( v183 < 0 || HIBYTE(v240) )
{
LABEL_320:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite(*((_QWORD *)v24 + 6), 1);
TokenTrustLevel = SepLocateTokenTrustLevel((_SECURITY_SUBJECT_CONTEXT *)&Result[4]);
SeLogAccessFailure(v24, 0i64, 0i64, (UINT64)TokenTrustLevel, v186);
ExReleaseResourceLite(*((PERESOURCE *)v24 + 6));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v41 = (unsigned int)RemainingDesiredAccess;
v27 = v177;
v30 = v186;
v43 = PreviouslyGrantedAccess;
}
}
if( v27 >= 0
&& v183 < 0
&& !HIDWORD(PackageCapabilityInfo)
&& (*((_DWORD *)v24 + 50) & 0x4000) != 0
&& SepLpacCausedAccessFailure((INT64)&PackageCapabilityInfo, v41) )
{
SepLogLpacAccessFailure();
}
LABEL_77:
if( v193 )
goto LABEL_89;
v53 = v216;
if( v216 == 2 )
{
if( ReturnSomeAccessGranted )
v176 = SepAdtAuditObjectAccessWithContext(
0i64,
ObjectTypeName,
ReturnSomeAccessGranted,
0,
(_SECURITY_SUBJECT_CONTEXT *)&Result[4],
0,
FlatSubCategoryId);
if( !ReturnSomeAccessDenied )
{
LABEL_82:
v54 = v173;
goto LABEL_83;
}
v54 = SepAdtAuditObjectAccessWithContext(
0i64,
ObjectTypeName,
0,
ReturnSomeAccessDenied,
(_SECURITY_SUBJECT_CONTEXT *)&Result[4],
0,
FlatSubCategoryId);
v173 = v54;
}
else
{
if( ReturnSomeAccessGranted )
{
FlatSubCategoryId[0] = 151;
v176 = SepAdtAuditThisEventWithContext(
0x97ui64,
ReturnSomeAccessGranted,
0,
(_SECURITY_SUBJECT_CONTEXT *)&Result[4]);
}
if( !ReturnSomeAccessDenied )
goto LABEL_82;
FlatSubCategoryId[0] = 151;
v54 = SepAdtAuditThisEventWithContext(
0x97ui64,
0,
ReturnSomeAccessDenied,
(_SECURITY_SUBJECT_CONTEXT *)&Result[4]);
v173 = v54;
}
LABEL_83:
v55 = v176;
if( v176 || v54 )
{
v129 = *(VOID **)&Result[20];
if( *(_QWORD *)&Result[4] )
v129 = *(VOID **)&Result[4];
v130 = *(_WORD *)(v30 + 2);
if( (v130 & 0x10) != 0 )
{
if( v130 >= 0 )
{
v131 = *(_ACL **)(v30 + 24);
}
else
{
v132 = *(unsigned int *)(v30 + 12);
if( (_DWORD)v132 )
v131 = (_ACL *)(v30 + v132);
else
v131 = 0i64;
}
}
else
{
v131 = 0i64;
}
if( (v130 & 0x10) != 0 )
{
if( v130 >= 0 )
{
v133 = *(_ACL **)(v30 + 24);
}
else
{
v134 = *(unsigned int *)(v30 + 12);
if( (_DWORD)v134 )
v133 = (_ACL *)(v30 + v134);
else
v133 = 0i64;
}
}
else
{
v133 = 0i64;
}
v135 = v41 | v43;
v56 = (UINT64 *)v179;
v136 = a17;
LODWORD(TrustCheckInfoc) = ObjectTypeListLength;
SepExamineSaclEx(
v133,
v131,
v129,
v135,
CapturedObjectTypeList,
(UINT64)TrustCheckInfoc,
a17,
AccessStatus,
(UINT64 *)v179,
PrincipalSelfSid,
TokenIsOwner,
&v184[2],
&GenerateFailureAudit);
v137 = *(VOID **)&Result[20];
if( *(_QWORD *)&Result[4] )
v137 = *(VOID **)&Result[4];
v138 = *(_WORD *)(v30 + 2);
if( (v138 & 0x10) != 0 )
{
if( v138 >= 0 )
{
v139 = *(_ACL **)(v30 + 24);
}
else
{
v140 = *(unsigned int *)(v30 + 12);
if( (_DWORD)v140 )
v139 = (_ACL *)(v30 + v140);
else
v139 = 0i64;
}
}
else
{
v139 = 0i64;
}
v164 = v136;
v57 = ObjectTypeListLength;
LODWORD(TrustCheckInfoe) = ObjectTypeListLength;
SepExamineGlobalSaclEx(
ObjectTypeName,
v139,
v137,
v135,
CapturedObjectTypeList,
(UINT64)TrustCheckInfoe,
v164,
AccessStatus,
v56,
PrincipalSelfSid,
TokenIsOwner,
&v184[2],
&GenerateFailureAudit);
v55 = v176;
v54 = v173;
}
else
{
v56 = (UINT64 *)v179;
v57 = ObjectTypeListLength;
}
if( v184[2] || GenerateFailureAudit )
{
v141 = (unsigned __int8)v197;
if( ReturnSomeAccessGranted )
v141 = 1;
v197 = v141;
v58 = a17;
if( v184[2] && v55 )
{
v142 = (__int64)v56;
if( !a17 )
v142 = 0i64;
p_HandleId = (PVOID *)&HandleId;
if( !ReturnSomeAccessGranted )
p_HandleId = 0i64;
v30 = v186;
SepAdtOpenObjectAuditAlarm(
FlatSubCategoryId[0],
(__int64)DestString,
p_HandleId,
&ObjectTypeName->Length,
(__int64)P,
(PVOID)v186,
*(__int64 *)&Result[4],
*(__int64 *)&Result[20],
*(_DWORD *)v56,
*(_DWORD *)v56,
(__int64)PrivilegeSet,
1u,
(__int64)KeGetCurrentThread()->ApcState.Process->UniqueProcessId,
v53,
(__int64)CapturedObjectTypeList,
v57,
v142,
0i64,
0i64);
v54 = v173;
}
if( GenerateFailureAudit && v54 )
{
v144 = (__int64)v56;
if( !v58 )
v144 = 0i64;
v145 = (PVOID *)&HandleId;
if( !ReturnSomeAccessGranted )
v145 = 0i64;
v30 = v186;
SepAdtOpenObjectAuditAlarm(
FlatSubCategoryId[0],
(__int64)DestString,
v145,
&ObjectTypeName->Length,
(__int64)P,
(PVOID)v186,
*(__int64 *)&Result[4],
*(__int64 *)&Result[20],
(int)RemainingDesiredAccess,
(int)RemainingDesiredAccess,
(__int64)PrivilegeSet,
0,
(__int64)KeGetCurrentThread()->ApcState.Process->UniqueProcessId,
v53,
(__int64)CapturedObjectTypeList,
v57,
v144,
0i64,
0i64);
}
goto LABEL_90;
}
if( PrivilegeSet && ReturnSomeAccessGranted )
{
LODWORD(DesiredAccessa) = (_DWORD)RemainingDesiredAccess;
SepAdtPrivilegeObjectAuditAlarm(
DestString,
ObjectTypeName,
(_UNICODE_STRING *)P,
&HandleId,
*(_TOKEN **)&Result[4],
*(_TOKEN **)&Result[20],
KeGetCurrentThread()->ApcState.Process->UniqueProcessId,
DesiredAccessa,
PrivilegeSet,
ReturnSomeAccessGranted);
v59 = 0;
v30 = v186;
v58 = a17;
LABEL_91:
SeUnlockSubjectContext((PSECURITY_SUBJECT_CONTEXT)&Result[4]);
if( v58 )
{
v62 = 0;
v203 = 0;
if( AccessStatus )
{
v22 = (char *)v179;
v69 = Address;
v70 = v208;
while( v62 < (unsigned int)ObjectTypeListLength )
{
v71 = 4i64 * v62;
v69[(unsigned __int64)v71 / 4] = *(_DWORD *)((char *)AccessStatus + v71);
*(_DWORD *)(v70 + v71) = *(_DWORD *)&v22[v71];
if( SepRmEnforceCap && v175 && *(int *)((char *)AccessStatus + v71) >= 0 )
{
v69[v62] = *((_DWORD *)v206 + v62);
*(_DWORD *)(v70 + 4i64 * v62) &= *((_DWORD *)v187 + v62);
}
v203 = ++v62;
v30 = v186;
}
goto LABEL_95;
}
v63 = v183;
v64 = (char *)Address;
v65 = v208;
v66 = v175;
while( v62 < (unsigned int)ObjectTypeListLength )
{
v67 = (int *)&v64[4 * v62];
*v67 = v63;
v68 = (_DWORD *)(v65 + 4i64 * v62);
*v68 = HIDWORD(PreviouslyGrantedAccess);
if( SepRmEnforceCap && v66 )
{
v63 = v183;
if( v183 >= 0 )
{
*v67 = v183;
*v68 &= HIDWORD(PreviouslyGrantedAccess);
}
}
else
{
v63 = v183;
}
v203 = ++v62;
v30 = v186;
}
}
else
{
v60 = Address;
*(_DWORD *)Address = v183;
v61 = (_DWORD *)v208;
*(_DWORD *)v208 = HIDWORD(PreviouslyGrantedAccess);
if( SepRmEnforceCap && v175 && v183 >= 0 )
{
*v60 = *(_DWORD *)v206;
v21 = (int *)v187;
*v61 &= *(_DWORD *)v187;
v30 = v186;
v22 = (char *)v179;
goto LABEL_115;
}
v30 = v186;
}
v22 = (char *)v179;
LABEL_95:
v21 = (int *)v187;
LABEL_115:
*v221 = v59;
v27 = 0;
v177 = 0;
v23 = PreviousMode;
goto LABEL_116;
}
LABEL_89:
v58 = a17;
LABEL_90:
v59 = v197;
goto LABEL_91;
}
v96 = ExAllocatePoolWithTag(
1ui64,
8i64 * (unsigned int)ObjectTypeListLength,
1632068947i64);
v179 = v96;
if( v96 )
{
v181 = 1;
AccessStatus = (INT64 *)((char *)v96 + 4 * (unsigned int)ObjectTypeListLength);
v97 = 0;
v98 = ObjectTypeListLength;
while( v97 < v98 )
{
v99 = 4i64 * v97;
*(_DWORD *)((char *)v96 + v99) = HIDWORD(PreviouslyGrantedAccess);
*(_DWORD *)((char *)AccessStatus + v99) = v183;
++v97;
}
LABEL_210:
v41 = (unsigned int)RemainingDesiredAccess;
goto LABEL_71;
}
LABEL_237:
v27 = -1073741670;
SeUnlockSubjectContext((PSECURITY_SUBJECT_CONTEXT)&Result[4]);
v23 = PreviousMode;
v22 = (char *)v179;
v21 = (int *)v187;
goto LABEL_116;
}
ReturnResultList = a17;
if( a17 )
{
GrantedAccess = ExAllocatePoolWithTag(
1ui64,
8i64 * (unsigned int)ObjectTypeListLength,
1632068947i64);
v179 = GrantedAccess;
if( !GrantedAccess )
goto LABEL_237;
v181 = 1;
AccessStatus = (INT64 *)((char *)GrantedAccess + 4 * (unsigned int)ObjectTypeListLength);
ReturnResultList = a17;
}
else
{
GrantedAccess = (VOID **)((char *)&PreviouslyGrantedAccess + 4);
v179 = (char *)&PreviouslyGrantedAccess + 4;
AccessStatus = (INT64 *)&v183;
}
Src = AccessStatus;
LODWORD(PackageCapabilityInfo) = v199;
LODWORD(ConditionSize) = v43;
v49 = (unsigned int)ObjectTypeListLength;
LODWORD(p_MandatoryInformation) = ObjectTypeListLength;
LODWORD(OutputSecurityDescriptorc) = v41;
SepAccessCheck(
(VOID *)v30,
PrincipalSelfSid,
*(_TOKEN **)&Result[20],
(_TOKEN *)v24,
(UINT64)OutputSecurityDescriptorc,
CapturedObjectTypeList,
(UINT64)p_MandatoryInformation,
&GenericMapping,
ConditionSize,
PreviousMode,
(UINT64 *)GrantedAccess,
0i64,
AccessStatus,
ReturnResultList,
TokenIsOwner,
(_SE_PACKAGE_CAPABILITY_INFO *)&PackageCapabilityInfo,
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)&ResourceInfo,
&ReturnSomeAccessGranted,
&ReturnSomeAccessDenied);
if( SepRmEnforceCap && *(int *)AccessStatus >= 0 && v182 )
{
if( ReturnResultList )
{
LODWORD(v30) = v49;
v100 = ExAllocatePoolWithTag(1ui64, 8 * v49, 1632068947i64);
v21 = (int *)v100;
v187 = v100;
if( !v100 )
{
SeUnlockSubjectContext((PSECURITY_SUBJECT_CONTEXT)&Result[4]);
SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)&Result[4]);
v27 = -1073741670;
v23 = PreviousMode;
v22 = (char *)v179;
goto LABEL_371;
}
v101 = (INT64 *)((char *)v100 + 4 * v49);
}
else
{
v21 = &v222;
v187 = &v222;
v101 = (INT64 *)&v223;
}
v206 = v101;
if( (_DWORD)ObjectTypeListLength )
{
v27 = SepCopyObjectTypeList(
CapturedObjectTypeList,
(unsigned int)ObjectTypeListLength,
&NewObjectTypeList);
v177 = v27;
if( v27 < 0 )
{
v23 = PreviousMode;
v22 = (char *)v179;
goto LABEL_371;
}
}
else
{
v27 = v177;
}
LOBYTE(v30) = 0;
v198 = v30;
v102 = 0;
v41 = (unsigned int)RemainingDesiredAccess;
v43 = PreviouslyGrantedAccess;
v50 = ObjectTypeListLength;
while( 1 )
{
v201 = v102;
if( v102 >= HIDWORD(a2[2].Linkage.Blink) )
break;
v103 = *(&a2[2].Signature + v102);
ObjectTypeList = (_OBJECT_TYPE_LIST *)v103;
if( !*(_QWORD *)(v103 + 24) )
goto LABEL_290;
v104 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)ResourceInfo;
if( !ResourceInfo )
{
LODWORD(v30) = (unsigned __int8)v30;
if( AuthzBasepInitializeResourceClaimsFromSacl(
pSacl,
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)&ResourceInfo) < 0 )
LODWORD(v30) = 1;
v198 = v30;
v104 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)ResourceInfo;
}
v105 = (_QWORD *)*((_QWORD *)v24 + 137);
v106 = v105 ? (VOID *)v105[75] : 0i64;
v107 = v105 ? (VOID *)v105[73] : 0i64;
v108 = v105 ? (VOID *)v105[74] : 0i64;
v109 = v105 ? (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v105[72] : 0i64;
LODWORD(ConditionSizea) = *(_DWORD *)(v103 + 16);
v110 = AuthzBasepEvaluateAceCondition(
v24,
*((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)v24 + 97),
v104,
v109,
v108,
v107,
v106,
*(UINT8 **)(v103 + 24),
ConditionSizea,
1u,
0,
(INT64 *)Result);
v27 = v110;
v177 = v110;
v111 = *(_DWORD *)Result;
if( *(_DWORD *)Result == 1 )
goto LABEL_290;
if( v110 < 0 )
goto LABEL_303;
if( SeTokenIsRestricted(v24) )
{
v112 = (_QWORD *)*((_QWORD *)v24 + 137);
if( v112 )
v113 = (VOID *)v112[75];
else
v113 = 0i64;
if( v112 )
v114 = (VOID *)v112[73];
else
v114 = 0i64;
if( v112 )
v115 = (VOID *)v112[74];
else
v115 = 0i64;
if( v112 )
v116 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v112[72];
else
v116 = 0i64;
LODWORD(ConditionSizea) = *(_DWORD *)(v103 + 16);
v27 = AuthzBasepEvaluateAceCondition(
v24,
*((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)v24 + 97),
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)ResourceInfo,
v116,
v115,
v114,
v113,
*(UINT8 **)(v103 + 24),
ConditionSizea,
1u,
1u,
(INT64 *)Result);
v177 = v27;
if( v27 < 0 )
goto LABEL_303;
v111 = *(_DWORD *)Result;
}
if( (_BYTE)v198 || v111 == 1 )
{
LABEL_290:
if( (*(_DWORD *)(v103 + 48) & 1) != 0 )
{
if( (v41 & 0x2000000) != 0 )
v117 = v41;
else
v117 = v41 | v43;
v118 = 0;
}
else
{
v117 = v41;
v118 = v43;
}
v27 = SepBuildCapeSecurityDescriptor(
CapeSecurityDescriptor,
*(PVOID *)&ObjectTypeList[2].Level,
pSacl);
v177 = v27;
if( v27 < 0 )
{
LABEL_303:
v23 = PreviousMode;
v22 = (char *)v179;
v21 = (int *)v187;
goto LABEL_371;
}
LODWORD(ConditionSizea) = v118;
LODWORD(v163) = ObjectTypeListLength;
v119 = NewObjectTypeList;
LODWORD(OutputSecurityDescriptord) = v117;
SepAccessCheck(
CapeSecurityDescriptor,
PrincipalSelfSid,
*(_TOKEN **)&Result[20],
*(_TOKEN **)&Result[4],
(UINT64)OutputSecurityDescriptord,
NewObjectTypeList,
v163,
&GenericMapping,
ConditionSizea,
PreviousMode,
(UINT64 *)v187,
0i64,
v206,
a17,
TokenIsOwner,
(_SE_PACKAGE_CAPABILITY_INFO *)&PackageCapabilityInfo,
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)&ResourceInfo,
&v191,
&v192);
v120 = *(_DWORD *)v187;
if( v175 )
v120 = v200 & *(_DWORD *)v187;
v200 = v120;
v50 = ObjectTypeListLength;
if( v119 )
SepMergeObjectTypeListAccesses(
CapturedObjectTypeList,
v119,
(unsigned int)ObjectTypeListLength);
v175 = 1;
}
else
{
v50 = ObjectTypeListLength;
}
v102 = v201 + 1;
LOBYTE(v30) = v198;
}
ReturnSomeAccessGranted = v191;
ReturnSomeAccessDenied = v192;
v121 = v200;
*(_DWORD *)v187 &= v200;
AccessStatus = (INT64 *)Src;
if( !v121 )
{
*(_DWORD *)v206 = -1073741790;
ReturnSomeAccessGranted = 0;
ReturnSomeAccessDenied = 1;
}
}
else
{
v41 = (unsigned int)RemainingDesiredAccess;
v27 = v177;
v43 = PreviouslyGrantedAccess;
v50 = ObjectTypeListLength;
}
if( (v41 & 0x2000000) != 0 )
{
if( !v174
|| !*(_WORD *)((char *)&v240 + 5)
&& !ext_ms_win_ntos_tm_l1_1_0_TmIsKTMCommitCoordinator((_KTRANSACTION *)0xC0000022i64) )
{
if( a17 )
v77 = v50;
else
v77 = 0;
LODWORD(TrustCheckInfoc) = v77;
SepConstrainByMandatory(
&MandatoryInformation,
v41,
(UINT64 *)v179,
AccessStatus,
0i64,
(UINT64)TrustCheckInfoc);
}
}
else if( v174 && !*(_WORD *)((char *)&v240 + 5) )
{
if( !ext_ms_win_ntos_tm_l1_1_0_TmIsKTMCommitCoordinator((_KTRANSACTION *)0xC0000022i64)
|| HIDWORD(PackageCapabilityInfo) )
{
ReturnSomeAccessGranted = 0;
ReturnSomeAccessDenied = 1;
v123 = 0;
HIDWORD(PreviouslyGrantedAccess) = 0;
v183 = v122;
v51 = a17;
if( a17 )
{
v124 = 0;
v52 = (CHAR *)v179;
v125 = ObjectTypeListLength;
while( v124 < v125 )
{
v126 = 4i64 * v124;
*(_DWORD *)&v52[v126] = v123;
*(_DWORD *)((char *)AccessStatus + v126) = v183;
++v124;
v123 = HIDWORD(PreviouslyGrantedAccess);
}
v51 = a17;
goto LABEL_69;
}
LABEL_68:
v52 = (CHAR *)v179;
LABEL_69:
if( (v41 & 0x2000000) != 0 )
{
v78 = ObjectTypeListLength;
if( v51 )
v79 = ObjectTypeListLength;
else
v79 = 0;
LODWORD(TrustCheckInfoc) = v79;
SepConstrainByConstraintMask(
(unsigned int)v211,
v41,
v52,
(CHAR *)AccessStatus,
0i64,
(UINT64)TrustCheckInfoc,
v184);
if( a17 )
v80 = v78;
else
v80 = 0;
LODWORD(TrustCheckInfod) = v80;
SepConstrainByConstraintMask(
(unsigned int)v219,
v41,
(CHAR *)v179,
(CHAR *)AccessStatus,
0i64,
(UINT64)TrustCheckInfod,
&v184[1]);
}
v30 = v186;
goto LABEL_71;
}
HIBYTE(v240) = 1;
ReturnSomeAccessGranted = 1;
ReturnSomeAccessDenied = 0;
HIDWORD(PreviouslyGrantedAccess) = v41;
v183 = 0;
}
v51 = a17;
goto LABEL_68;
}
}
goto LABEL_217;
}
}
LABEL_54:
v43 = PreviouslyGrantedAccess;
goto LABEL_55;
}
goto LABEL_190;
}
v27 = SepFilterCheck(v30, &ResourceInfo, v24, 1, (INT64)&v219);
if( v27 >= 0 )
{
v27 = SepFilterToDiscretionary(&v219, v41);
v177 = v27;
if( v27 < 0 )
v184[1] = 1;
goto LABEL_48;
}
LABEL_190:
v23 = PreviousMode;
goto LABEL_191;
}
}
goto LABEL_187;
}
}
}
LABEL_192:
v27 = -1073741703;
v22 = (char *)v179;
v21 = (int *)v179;
goto LABEL_116;
}
if( (a10 & 1) != 0 )
{
v193 = 1;
goto LABEL_24;
}
v27 = -1073741727;
LABEL_187:
v22 = (char *)v179;
v21 = (int *)v179;
goto LABEL_371;
}
v84 = *a3;
Object = 0i64;
v27 = ObReferenceObjectByHandle(v84, 8ui64, (_OBJECT_TYPE *)SeTokenObjectType, v23, &Object, 0i64);
DmaAdapter = (PADAPTER_OBJECT)Object;
if( v27 >= 0 )
{
v232 = v24;
v24 = Object;
*(_QWORD *)&Result[4] = Object;
v194 = 1;
goto LABEL_21;
}
DmaAdapter = 0i64;
v30 = v186;
v22 = (char *)v179;
v21 = (int *)v179;
if( v27 != -1073741816 )
v195 = 1;
LABEL_116:
if( v194 )
{
HalPutDmaAdapter(DmaAdapter);
*(_QWORD *)&Result[4] = v232;
}
if( PrivilegeSet )
ExFreePoolWithTag(PrivilegeSet, 0);
SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)&Result[4]);
SeReleaseSecurityDescriptor((VOID *)v30, v23, 0);
if( DestString )
ExFreePoolWithTag(DestString, 0);
if( ObjectTypeName )
ExFreePoolWithTag(ObjectTypeName, 0);
if( P )
ExFreePoolWithTag(P, 0);
if( PrincipalSelfSid )
SeReleaseSid(PrincipalSelfSid, v23, 1u);
if( CapturedObjectTypeList )
SeFreeCapturedObjectTypeList(CapturedObjectTypeList);
if( v181 )
{
if( v22 )
ExFreePoolWithTag(v22, 0);
if( v21 )
ExFreePoolWithTag(v21, 0);
}
if( v182 )
{
Blink = a2[1].Linkage.Blink;
if( Blink )
SepRmDereferenceCapTable((_SEP_CENTRALIZED_ACCESS_POLICIES_TABLE *)Blink);
}
if( NewObjectTypeList )
ExFreePoolWithTag(NewObjectTypeList, 0);
SepFreeResourceInfo((VOID *)ResourceInfo);
if( v27 == -1073741670 || v195 )
SepAuditFailed((unsigned int)v27);
return v27;
}