SepCreateAccessStateFromSubjectContext

VOID __fastcall SepCreateAccessStateFromSubjectContext(
        _SECURITY_SUBJECT_CONTEXT *SubjectContext,
        _ACCESS_STATE *AccessState,
        _AUX_ACCESS_DATA *AuxData,
        UINT64 DesiredAccess,
        _GENERIC_MAPPING *GenericMapping){
  _GENERIC_MAPPING *v5; 
  int v6; 
  __int64 v10; 
  __int64 v11; 
  UINT64 AccessMask; 
  v5 = GenericMapping;
  v6 = DesiredAccess;
  LODWORD(AccessMask) = DesiredAccess;
  if( (DesiredAccess & 0xF0000000) != 0 && GenericMapping )
  {
    RtlMapGenericMask(&AccessMask, GenericMapping);
    v6 = AccessMask;
  }
  memset((INT64)AccessState, 0i64);
  memset((INT64)AuxData, 0i64);
  *((_QWORD *)AccessState + 9) = AuxData;
  *((_OWORD *)AccessState + 2) = *(_OWORD *)&SubjectContext->ClientToken;
  *((_OWORD *)AccessState + 3) = *(_OWORD *)&SubjectContext->PrimaryToken;
  v10 = *((_QWORD *)AccessState + 4);
  if( v10 )
    v11 = *((_QWORD *)AccessState + 4);
  else
    v11 = *((_QWORD *)AccessState + 6);
  if( (*(_DWORD *)(v11 + 64) & *(_DWORD *)(v11 + 72) & 0x800000) != 0 )
    *((_DWORD *)AccessState + 3) = 1;
  if( !v10 )
    v10 = *((_QWORD *)AccessState + 6);
  *((_DWORD *)AccessState + 3) |= *(_DWORD *)(v10 + 200) & 0x810;
  *((_DWORD *)AccessState + 4) = v6;
  *((_DWORD *)AccessState + 6) = v6;
  AuxData->PrivilegesUsed = (_PRIVILEGE_SET *)((char *)AccessState + 80);
  *(_QWORD *)AccessState = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
  if( v5 )
    AuxData->GenericMapping = *v5;
}

Referenced by: