SepPrivilegeCheck
CHAR __fastcall SepPrivilegeCheck(INT64 a1, INT64 a2, UINT64 a3, CHAR a4, CHAR a5){
int v5;
__int64 v7;
_DWORD *v8;
__int64 v9;
int v10;
unsigned __int8 v11;
__int64 v13;
__int64 v14;
v5 = 0;
v14 = 0i64;
v13 = 0i64;
if( a5 )
{
_InterlockedExchange64(&v14, *(_QWORD *)(a1 + 72));
_InterlockedExchange64(&v13, *(_QWORD *)(a1 + 64));
v7 = v14 & v13;
_InterlockedOr((volatile signed __int32 *)&v13, 0);
if( (_DWORD)a3 )
{
v8 = (_DWORD *)(a2 + 8);
v9 = (unsigned int)a3;
do
{
v10 = *v8 & 0x7FFFFFFF;
v11 = _bittest64(&v7, (unsigned int)*(v8 - 2));
*v8 = v10;
if( v11 )
{
*v8 = v10 | 0x80000000;
++v5;
}
v8 += 3;
--v9;
}
while( v9 );
}
if( (a4 & 1) != 0 )
{
if( v5 != (_DWORD)a3 )
return 0;
}
else if( !v5 )
{
return 0;
}
}
return 1;
}Referenced by:
IopCheckBackupRestorePrivilege
NtPrivilegeCheck
PfQuerySuperfetchInformation
SeCheckAuditPrivilege
SePrivilegeCheck
SePrivilegePolicyCheck
SepAccessCheck
SepAccessCheckEx