WdipAccessCheck

INT64 __fastcall WdipAccessCheck(){
  ACL *v0; 
  unsigned int v1; 
  _DWORD *PoolWithTag; 
  UINT64 v3; 
  _DWORD *v4; 
  unsigned __int8 *v6; 
  unsigned int v7; 
  ACL *v8; 
  ACL *v9; 
  UINT64 v10; 
  INT64 AccessStatus; 
  __int16 v12; 
  DWORD GrantedAccess; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  GENERIC_MAPPING GenericMapping; 
  HIDWORD(AccessStatus) = 0;
  v12 = 1280;
  v0 = 0i64;
  GenericMapping.GenericRead = 131073;
  GrantedAccess = 0;
  GenericMapping.GenericWrite = 0x20000;
  GenericMapping.GenericExecute = 0x20000;
  GenericMapping.GenericAll = 2031617;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v1 = RtlLengthRequiredSid(6ui64);
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, v1, 0x73494457ui64);
  v4 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  LOBYTE(v3) = 6;
  LODWORD(AccessStatus) = RtlInitializeSid(PoolWithTag, (SID_IDENTIFIER_AUTHORITY *)((char *)&AccessStatus + 4), v3);
  if( (int)AccessStatus >= 0 )
  {
    v6 = (unsigned __int8 *)SeLocalSystemSid;
    v4[2] = 80;
    v4[3] = -1324354722;
    v4[4] = 78537857;
    v4[5] = 698502321;
    v4[6] = 558674196;
    v4[7] = 1451644582;
    v7 = 4 * (*((unsigned __int8 *)v4 + 1) + *((unsigned __int8 *)SeAliasAdminsSid + 1) + v6[1]) + 108;
    v8 = (ACL *)ExAllocatePoolWithTag(PagedPool, v7, 0x73494457ui64);
    v0 = v8;
    if( v8 )
    {
      v9 = v8 + 5;
      LODWORD(AccessStatus) = RtlCreateSecurityDescriptor(v8, 1ui64);
      if( (int)AccessStatus >= 0 )
      {
        LODWORD(AccessStatus) = RtlCreateAcl(v9, v7 - 40, 2u);
        if( (int)AccessStatus >= 0 )
        {
          LODWORD(AccessStatus) = RtlAddAccessAllowedAce(v9, 2u, 1u, SeAliasAdminsSid);
          if( (int)AccessStatus >= 0 )
          {
            LODWORD(AccessStatus) = RtlAddAccessAllowedAce(v9, 2u, 1u, SeLocalSystemSid);
            if( (int)AccessStatus >= 0 )
            {
              LODWORD(AccessStatus) = RtlAddAccessAllowedAce(v9, 2u, 1u, v4);
              if( (int)AccessStatus >= 0 )
              {
                LODWORD(AccessStatus) = RtlSetDaclSecurityDescriptor(v0, 1u, v9, 0);
                if( (int)AccessStatus >= 0 )
                {
                  SeCaptureSubjectContext(&SubjectContext);
                  LODWORD(v10) = 0;
                  SeAccessCheck(
                    v0,
                    &SubjectContext,
                    0,
                    1ui64,
                    v10,
                    0i64,
                    &GenericMapping,
                    1,
                    (UINT64 *)&GrantedAccess,
                    &AccessStatus);
                  SeReleaseSubjectContext(&SubjectContext);
                }
              }
            }
          }
        }
      }
    }
    else
    {
      LODWORD(AccessStatus) = -1073741670;
    }
  }
  ExFreePoolWithTag(v4, 0);
  if( v0 )
    ExFreePoolWithTag(v0, 0);
  return(unsigned int)AccessStatus;
}

Referenced by: