CMFCheckAccess

INT64 __fastcall CMFCheckAccess(VOID *Object, UINT64 DesiredAccess, CHAR PreviousMode){
  unsigned int AccessState; 
  GENERIC_MAPPING *GenericMapping; 
  unsigned int v7; 
  UINT8 v8; 
  bool v9; 
  UINT64 v11; 
  UINT64 GrantedAccess; 
  PVOID P; 
  UINT64 AccessMask; 
  INT64 AccessStatus; 
  PPRIVILEGE_SET Privileges; 
  struct _PRIVILEGE_SET RequiredPrivileges; 
  INT64 result[4]; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int64 v20[28]; 
  LODWORD(AccessMask) = DesiredAccess;
  memset((INT64)result, 0i64);
  memset((INT64)v20, 0i64);
  Privileges = 0i64;
  if( Object )
  {
    GenericMapping = (GENERIC_MAPPING *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)]
                                       + 76);
    RtlMapGenericMask(&AccessMask, GenericMapping);
    if( !*(_QWORD *)CMFSecurityDescriptor )
    {
      P = 0i64;
      AccessState = CMFCreateSecurityDescriptor(&P, GenericMapping);
      if( (AccessState & 0xC0000000) == -1073741824 )
        return AccessState;
      if( _InterlockedCompareExchange64((volatile signed __int64 *)CMFSecurityDescriptor, (signed __int64)P, 0i64) )
        ExFreePoolWithTag(P, 0);
    }
    v7 = AccessMask;
    AccessState = SeCreateAccessState(
                    (_ACCESS_STATE *)result,
                    (_AUX_ACCESS_DATA *)v20,
                    (unsigned int)AccessMask,
                    GenericMapping);
    if( (AccessState & 0xC0000000) != -1073741824 )
    {
      SeLockSubjectContext(&SubjectContext);
      RequiredPrivileges.Control = 0;
      RequiredPrivileges.Privilege[0].Attributes = 0;
      P = (PVOID)18;
      RequiredPrivileges.Privilege[0].Luid = (_LUID)18i64;
      RequiredPrivileges.PrivilegeCount = 1;
      v8 = SePrivilegeCheck(&RequiredPrivileges, &SubjectContext, PreviousMode);
      LODWORD(AccessStatus) = 0;
      v9 = v8;
      LODWORD(GrantedAccess) = 0;
      if( v8 )
      {
        LODWORD(GrantedAccess) = v7;
      }
      else
      {
        LODWORD(v11) = 0;
        v9 = SeAccessCheck(
               CMFSecurityDescriptor,
               &SubjectContext,
               1u,
               v7,
               v11,
               &Privileges,
               GenericMapping,
               PreviousMode,
               &GrantedAccess,
               &AccessStatus);
        if( Privileges )
        {
          SeAppendPrivileges((PACCESS_STATE)result, Privileges);
          CmSiFreeMemory(Privileges);
        }
      }
      SeUnlockSubjectContext(&SubjectContext);
      AccessState = AccessStatus;
      if( (AccessStatus & 0xC0000000) != -1073741824 )
      {
        if( !v9 || (~(_DWORD)GrantedAccess & v7) != 0 )
          AccessState = -1073741790;
        else
          AccessState = 0;
      }
      SepDeleteAccessState((ACCESS_STATE *)result);
      SeReleaseSubjectContext(&SubjectContext);
    }
  }
  else
  {
    return(unsigned int)-1073741811;
  }
  return AccessState;
}

Referenced by:

NtMapCMFModule