VfUtilIsLocalSystem

UINT64 __stdcall VfUtilIsLocalSystem(_EPROCESS *Process){
  unsigned int v2; 
  GENERIC_MAPPING *GenericMapping; 
  UINT64 v5; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  INT64 AccessStatus; 
  UINT64 GrantedAccess; 
  LODWORD(GrantedAccess) = 0;
  LODWORD(AccessStatus) = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( ViInitializeLocalSystemDescriptor() )
  {
    SeCaptureSubjectContextEx(0i64, Process, &SubjectContext);
    GenericMapping = IoGetFileObjectGenericMapping();
    LODWORD(v5) = 0;
    v2 = SeAccessCheck(
           ViLocalSystemDescriptor,
           &SubjectContext,
           0,
           1ui64,
           v5,
           0i64,
           GenericMapping,
           1,
           &GrantedAccess,
           &AccessStatus);
    SeReleaseSubjectContext(&SubjectContext);
  }
  else
  {
    return 1;
  }
  return v2;
}

Referenced by: