SepMaximumAccessCheck
INT64 __fastcall SepMaximumAccessCheck(
INT64 *Token,
VOID *rdx0,
INT64 r8_0,
INT64 a4,
INT64 *arg20,
VOID *PrincipalSelfSid,
UINT64 a2,
INT64 a1,
INT64 a9,
INT64 a10,
CHAR a11,
UINT8 a12,
INT64 a13,
CHAR a14){
unsigned int v14;
__int64 v15;
INT64 *v16;
int v17;
CHAR v18;
void *v19;
INT64 result;
INT64 v21;
unsigned int v22;
void *v23;
char v24;
unsigned __int8 *v25;
__int64 v26;
INT64 *v27;
int v28;
unsigned __int8 v29;
__int64 v30;
unsigned int v31;
unsigned __int64 v32;
int v33;
__int64 v34;
int v35;
__int64 v36;
unsigned int v37;
_DWORD *v38;
_DWORD *v39;
_DWORD *v40;
_DWORD *v41;
__int64 v42;
unsigned int *v43;
int v44;
unsigned int *v45;
__int64 v46;
unsigned int v47;
UINT8 v48;
INT64 v49;
unsigned __int16 v50;
unsigned int v51;
__int64 *v52;
_QWORD *v53;
__int64 v54;
__int64 v55;
__int64 v56;
unsigned int v57;
__int64 v58;
UINT64 v59;
UINT64 v60;
INT64 v61;
unsigned int v62;
int v63;
_DWORD *v64;
UINT8 v65;
INT64 v66;
unsigned int v67;
UINT8 v68;
_DWORD *v69;
INT64 v70;
_BYTE *a5;
_DWORD *a6;
unsigned int v73;
int v74;
int v75;
unsigned int v76;
int v77;
__int64 v78;
__int64 v79;
UINT64 a3;
INT64 v83;
v83 = a4;
v14 = a2;
v15 = 0i64;
v16 = Token;
v17 = Token[25] & 0x2000;
v18 = a11;
v19 = rdx0;
LODWORD(a3) = 0;
v77 = v17;
v74 = -1;
if( a11 && (_DWORD)a2 )
{
v42 = (unsigned int)a2;
v43 = (unsigned int *)(a1 + 28);
do
{
*(_QWORD *)(v43 - 1) = *v43;
v43 += 12;
--v42;
}
while( v42 );
}
result = *(unsigned __int16 *)(r8_0 + 4);
v21 = r8_0 + 8;
v76 = result;
v22 = 0;
if( !(_DWORD)result )
goto LABEL_33;
v23 = PrincipalSelfSid;
do
{
if( (*(_BYTE *)(v21 + 1) & 8) != 0 )
goto LABEL_32;
v24 = *(_BYTE *)v21;
if( *(_BYTE *)v21 )
{
switch( v24 )
{
case 5:
v63 = *(_DWORD *)(v21 + 8);
v64 = (_DWORD *)(v21 + 12);
if( (v63 & 1) == 0 )
v64 = 0i64;
if( v64 )
{
if( !(_DWORD)a9 )
goto LABEL_114;
if( !SepSidInToken(v16, v23, (PVOID)(v21 + ((8i64 * (v63 & 2)) | 0xC) + 16i64 * (v63 & 1)), 0, a11, a12) )
goto LABEL_28;
v66 = a1;
if( AuthzBasepObjectInTypeList(v64, a1, a2, &a3) )
{
LODWORD(a6) = 1;
LODWORD(a5) = *(_DWORD *)(v21 + 4);
AuthzBasepAddAccessTypeList(v66, (unsigned int)a2, (unsigned int)a3, v22, (INT64)a5, (INT64)a6);
goto LABEL_28;
}
v18 = a11;
goto LABEL_116;
}
v18 = a11;
v65 = SepSidInToken(v16, v23, (PVOID)(v21 + ((8i64 * (v63 & 2)) | 0xC) + 16i64 * (v63 & 1)), 0, a11, a12);
break;
case 4:
v68 = a12;
if( !SepSidInToken(v16, v23, (PVOID)(v21 + 4 * (*(unsigned __int8 *)(v21 + 13) + 5i64)), 0, v18, a12) )
goto LABEL_29;
v65 = SepSidInToken(v19, 0i64, (PVOID)(v21 + 12), 0, 0, v68);
break;
case 1:
v48 = SepSidInToken(v16, v23, (PVOID)(v21 + 8), 1u, v18, a12);
v14 = a2;
if( !v48 )
goto LABEL_30;
v49 = a1;
if( (_DWORD)a2 == 1 )
{
*(_DWORD *)(a1 + 32) |= *(_DWORD *)(v21 + 4) & ~*(_DWORD *)(a1 + 28);
goto LABEL_30;
}
LABEL_95:
LODWORD(a6) = 2;
LABEL_96:
v59 = v14;
LABEL_73:
v60 = 0i64;
LABEL_74:
LODWORD(a5) = *(_DWORD *)(v21 + 4);
AuthzBasepAddAccessTypeList(v49, v59, v60, v22, (INT64)a5, (INT64)a6);
goto LABEL_29;
case 6:
if( !SepSidInToken(
v16,
v23,
(PVOID)(v21 + ((8i64 * (*(_DWORD *)(v21 + 8) & 2)) | 0xC) + 16i64 * (*(_DWORD *)(v21 + 8) & 1)),
1u,
v18,
a12) )
goto LABEL_29;
v69 = (_DWORD *)(v21 + 12);
v15 = 0i64;
if( (*(_DWORD *)(v21 + 8) & 1) == 0 )
v69 = 0i64;
if( !v69 )
{
v14 = a2;
v49 = a1;
if( (_DWORD)a2 == 1 )
{
*(_DWORD *)(a1 + 32) |= *(_DWORD *)(v21 + 4) & ~*(_DWORD *)(a1 + 28);
goto LABEL_31;
}
goto LABEL_95;
}
if( !(_DWORD)a9 )
{
v14 = a2;
*(_DWORD *)(a1 + 32) |= *(_DWORD *)(v21 + 4) & ~*(_DWORD *)(a1 + 28);
goto LABEL_31;
}
v70 = a1;
if( AuthzBasepObjectInTypeList(v69, a1, a2, &a3) )
{
v60 = (unsigned int)a3;
v49 = v70;
v59 = (unsigned int)a2;
LODWORD(a6) = 2;
goto LABEL_74;
}
LABEL_116:
v14 = v67;
goto LABEL_30;
case 9:
v50 = *(_WORD *)(v21 + 2);
v51 = 4 * *(unsigned __int8 *)(v21 + 9) + 8;
if( (int)(v50 - v51 - 8) > 0 )
{
v52 = arg20;
if( a4 && !*arg20 )
{
AuthzBasepInitializeResourceClaimsFromSacl(a4, (__int64)arg20);
v50 = *(_WORD *)(v21 + 2);
v15 = 0i64;
}
v53 = (_QWORD *)v16[137];
if( v53 )
{
v54 = v53[75];
v55 = v53[73];
v56 = v53[74];
v15 = v53[72];
}
else
{
v54 = 0i64;
v55 = 0i64;
v56 = 0i64;
}
v57 = v50 - v51 - 8;
v58 = v51;
v18 = a11;
AuthzBasepEvaluateAceCondition(
(__int64)v16,
v16[97],
*v52,
v15,
v56,
v55,
v54,
(char *)(v21 + v58 + 8),
v57,
0,
a11,
&v74);
if( v74 != 1 )
goto LABEL_29;
if( !v17 && !v18 )
{
if( SepIsPackageSid((PVOID)(v21 + 8)) )
{
LABEL_43:
v40 = (_DWORD *)a13;
v41 = (_DWORD *)(a13 + 4);
SepMatchPackage(
(_TOKEN *)v16,
0xFFFFFFFFui64,
(VOID *)(v21 + 8),
*(unsigned int *)(v21 + 4),
(UINT8 *)(a13 + 21),
(UINT *)(a13 + 4),
(UINT8 *)(a13 + 20));
*v40 &= ~*v41;
goto LABEL_28;
}
if( SepIsCapabilitySid((PVOID)(v21 + 8)) )
{
LABEL_42:
v38 = (_DWORD *)a13;
v39 = (_DWORD *)(a13 + 8);
SepMatchCapability(
(INT64)v16,
0xFFFFFFFFi64,
(VOID *)(v21 + 8),
*(unsigned int *)(v21 + 4),
(_BYTE *)(a13 + 22),
(_DWORD *)(a13 + 8));
*v38 &= ~*v39;
goto LABEL_28;
}
}
if( !SepSidInToken(v16, v23, (PVOID)(v21 + 8), 0, v18, a12) )
goto LABEL_29;
v59 = (unsigned int)a2;
v49 = a1;
LODWORD(a6) = 1;
goto LABEL_73;
}
LABEL_114:
v18 = a11;
goto LABEL_32;
default:
goto LABEL_32;
}
v14 = a2;
if( !v65 )
goto LABEL_30;
v49 = a1;
if( (_DWORD)a2 == 1 )
{
*(_DWORD *)(a1 + 28) |= *(_DWORD *)(v21 + 4) & ~*(_DWORD *)(a1 + 32);
goto LABEL_30;
}
LODWORD(a6) = 1;
goto LABEL_96;
}
if( !v17 && !v18 )
{
if( SepIsPackageSid((PVOID)(v21 + 8)) )
goto LABEL_43;
if( SepIsCapabilitySid((PVOID)(v21 + 8)) )
goto LABEL_42;
}
v25 = (unsigned __int8 *)(v21 + 8);
v26 = 63i64;
if( !v18 )
v26 = 29i64;
v27 = &v16[v26];
if( a14 && v21 != -8 && RtlEqualSid(SeAliasAdminsSid, (PVOID)(v21 + 8)) )
goto LABEL_28;
if( v23 && RtlEqualSid(SePrincipalSelfSid, (PVOID)(v21 + 8)) )
v25 = (unsigned __int8 *)v23;
if( a12 && RtlEqualSid(SeOwnerRightsSid, v25) )
{
LABEL_22:
v14 = a2;
if( (_DWORD)a2 != 1 )
{
LODWORD(a6) = 1;
LODWORD(a5) = *(_DWORD *)(v21 + 4);
AuthzBasepAddAccessTypeList(a1, (unsigned int)a2, 0i64, v22, (INT64)a5, (INT64)a6);
goto LABEL_28;
}
v18 = a11;
*(_DWORD *)(a1 + 28) |= *(_DWORD *)(v21 + 4) & ~*(_DWORD *)(a1 + 32);
goto LABEL_30;
}
if( !v27 || !v25 )
goto LABEL_28;
v28 = v25[1];
v29 = 0;
v30 = *(unsigned __int16 *)v25;
v78 = v30;
v31 = 4 * v28 + 8;
v73 = v31;
v32 = v27[(v25[4 * ((unsigned __int64)(unsigned int)v30 >> 8) + 4] & 0xF) + 2] & v27[((unsigned __int64)v25[4 * ((unsigned __int64)(unsigned int)v30 >> 8) + 4] >> 4)
+ 18];
if( !v32 )
{
LABEL_27:
v37 = *(_DWORD *)v27;
if( *(_DWORD *)v27 > 0x40u )
{
v61 = v27[1];
v62 = 64;
do
{
v36 = v61 + 16i64 * v62;
if( **(_WORD **)v36 == (_WORD)v30 )
{
if( !memcmp(v25, *(PVOID *)v36, v31) )
goto LABEL_19;
LOWORD(v30) = v78;
v31 = v73;
}
++v62;
}
while( v62 < v37 );
}
goto LABEL_28;
}
while( 1 )
{
LOBYTE(v33) = v32;
if( (_BYTE)v32 )
break;
LABEL_26:
v29 += 8;
v32 >>= 8;
if( !v32 )
goto LABEL_27;
}
v34 = v27[1];
v79 = v34;
v35 = v29;
while( 1 )
{
v75 = *((unsigned __int8 *)SidHashByteToIndexLookupTable + (unsigned __int8)v33);
v36 = v34 + 16i64 * (unsigned int)(v35 + v75);
if( **(_WORD **)v36 == (_WORD)v30 )
break;
LABEL_25:
v33 = (unsigned __int8)v33 ^ (1 << v75);
v35 = v29;
if( !(_BYTE)v33 )
goto LABEL_26;
}
if( memcmp(v25, *(PVOID *)v36, v31) )
{
LOWORD(v30) = v78;
v31 = v73;
v34 = v79;
goto LABEL_25;
}
LABEL_19:
if( !a11 && v36 == v27[1] && (*(_DWORD *)(v36 + 8) & 0x10) == 0 || (*(_DWORD *)(v36 + 8) & 4) != 0 )
goto LABEL_22;
LABEL_28:
v18 = a11;
LABEL_29:
v14 = a2;
LABEL_30:
v15 = 0i64;
LABEL_31:
a4 = v83;
LABEL_32:
result = *(unsigned __int16 *)(v21 + 2);
++v22;
v17 = v77;
v21 += result;
v16 = Token;
v23 = PrincipalSelfSid;
v19 = rdx0;
}
while( v22 < v76 );
LABEL_33:
if( v18 && v14 )
{
v44 = ~(_DWORD)a10;
v45 = (unsigned int *)(a1 + 28);
v46 = v14;
do
{
v47 = *v45;
v45 += 12;
result = *(v45 - 13) & (v44 | v47);
*(v45 - 12) = result;
--v46;
}
while( v46 );
}
return result;
}Referenced by:
SepAccessCheck