ObCheckCreateObjectAccess

UINT8 __stdcall ObCheckCreateObjectAccess(
        PVOID DirectoryObject,
        UINT64 CreateAccess,
        _ACCESS_STATE *AccessState,
        _UNICODE_STRING *ComponentName,
        UINT8 TypeMutexLocked,
        CHAR PreviousMode,
        INT64 *AccessStatus){
  CHAR AccessMode; 
  unsigned int v9; 
  unsigned __int64 v10; 
  __int64 v11; 
  NTSTATUS ObjectSecurity; 
  UINT8 v13; 
  UINT64 v15; 
  UINT64 GrantedAccess; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  PPRIVILEGE_SET Privileges; 
  BOOLEAN MemoryAllocated; 
  AccessMode = PreviousMode;
  LODWORD(GrantedAccess) = 0;
  Privileges = 0i64;
  SecurityDescriptor = 0i64;
  v9 = CreateAccess;
  v10 = (unsigned __int8)*((char *)DirectoryObject - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DirectoryObject - 48) >> 8);
  MemoryAllocated = 0;
  v11 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v10];
  ObjectSecurity = ObpGetObjectSecurity(DirectoryObject, &SecurityDescriptor, &MemoryAllocated, PreviousMode);
  if( ObjectSecurity < 0 )
  {
    *(_DWORD *)AccessStatus = ObjectSecurity;
    return 0;
  }
  else
  {
    SeLockSubjectContext((_SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
    if( SecurityDescriptor )
    {
      LODWORD(v15) = 0;
      v13 = SeAccessCheck(
              SecurityDescriptor,
              (SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
              1u,
              v9,
              v15,
              &Privileges,
              (GENERIC_MAPPING *)(v11 + 76),
              AccessMode,
              &GrantedAccess,
              AccessStatus);
      if( Privileges )
      {
        SeAppendPrivileges(AccessState, Privileges);
        CmSiFreeMemory(Privileges);
      }
    }
    else
    {
      v13 = 1;
    }
    SeUnlockSubjectContext((SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
    ObReleaseObjectSecurity(SecurityDescriptor, MemoryAllocated);
    return v13;
  }
}

Referenced by: