ObpVerifyCreatorAccessCheck

INT64 __fastcall ObpVerifyCreatorAccessCheck(_DWORD *a1){
  _ETHREAD *CurrentThread; 
  _DWORD *PrimaryToken; 
  UINT64 v4; 
  UINT *v5; 
  int v6; 
  int v7; 
  struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  PVOID TokenInformation; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  PVOID P[2]; 
  __int64 v13; 
  char Sid[80]; 
  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_WORD *)&IdentifierAuthority.Value[4] = 4096;
  memset((INT64)Sid, 0i64);
  TokenInformation = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v13 = 0i64;
  *(_OWORD *)P = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  SeCaptureSubjectContextEx(CurrentThread, *((_EPROCESS **)CurrentThread + 23), &SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  if( PrimaryToken[48] == 2 && (int)PrimaryToken[49] < 2 )
    goto LABEL_14;
  SeQueryInformationToken(PrimaryToken, TokenIsAppContainer, &TokenInformation);
  if( !(_DWORD)TokenInformation
    || (LODWORD(v13) = SeQueryInformationToken(PrimaryToken, TokenAppContainerSid, P), (int)v13 >= 0) )
  {
    SeQueryInformationToken(PrimaryToken, TokenIntegrityLevel, (PVOID *)((char *)&TokenInformation + 4));
    LOBYTE(v4) = 1;
    RtlInitializeSid(Sid, &IdentifierAuthority, v4);
    v5 = RtlSubAuthoritySid(Sid, 0i64);
    *v5 = HIDWORD(TokenInformation);
    P[1] = Sid;
    SeLockSubjectContext(&SubjectContext);
    v6 = RtlEnumerateBoundaryDescriptorEntries(
           a1,
           (unsigned int(__fastcall *)(_DWORD *, __int64))ObpVerifyAccessToBoundaryEntry,
           (__int64)&SubjectContext);
    SeUnlockSubjectContext(&SubjectContext);
    v7 = v13;
    if( (int)v13 >= 0 )
    {
      if( v6 < 0 )
        v7 = v6;
      LODWORD(v13) = v7;
      if( v7 >= 0 && P[0] && (v13 & 0x100000000i64) == 0 )
LABEL_14:
        LODWORD(v13) = -1073741790;
    }
  }
  SeReleaseSubjectContext(&SubjectContext);
  if( P[0] )
    ExFreePoolWithTag(P[0], 0);
  return(unsigned int)v13;
}

Referenced by: