IopCheckBackupRestorePrivilege

VOID __stdcall IopCheckBackupRestorePrivilege(
        _ACCESS_STATE *AccessState,
        UINT64 *CreateOptions,
        CHAR PreviousMode,
        UINT64 Disposition){
  char v5; 
  int v6; 
  char v7; 
  int v10; 
  INT64 v11; 
  int v12; 
  struct _PRIVILEGE_SET RequiredPrivileges; 
  v5 = 0;
  v6 = *((_DWORD *)AccessState + 3);
  v7 = 0;
  if( (v6 & 0x100) != 0 || (*(_DWORD *)CreateOptions & 0x4000) == 0 )
    return;
  v10 = *((_DWORD *)AccessState + 4);
  *((_DWORD *)AccessState + 3) = v6 | 0x100;
  if( (v10 & 0x2000000) != 0 )
    v10 |= 0x11F01BFu;
  if( (((_DWORD)Disposition - 1) & 0xFFFFFFF9) != 0 || (_DWORD)Disposition == 7 )
  {
    v7 = 1;
  }
  else
  {
    if( (v10 & 0x11200A9) == 0 )
      goto LABEL_12;
    RequiredPrivileges.Privilege[0].Luid = SeBackupPrivilege;
    RequiredPrivileges.PrivilegeCount = 1;
    RequiredPrivileges.Control = 1;
    RequiredPrivileges.Privilege[0].Attributes = 0;
    if( !PreviousMode )
    {
LABEL_19:
      v5 = 1;
      SeAppendPrivileges(AccessState, &RequiredPrivileges);
      *((_DWORD *)AccessState + 5) |= v10 & 0x11200A9;
      v10 &= 0xFEEDFF56;
      *((_DWORD *)AccessState + 4) &= 0xFEEDFF56;
      *((_DWORD *)AccessState + 3) |= 2u;
      goto LABEL_12;
    }
    v11 = *((_QWORD *)AccessState + 4);
    if( !v11 )
    {
      v11 = *((_QWORD *)AccessState + 6);
      goto LABEL_11;
    }
    if( *((int *)AccessState + 10) >= 2 )
    {
LABEL_11:
      if( !SepPrivilegeCheck(v11, (INT64)RequiredPrivileges.Privilege, 1ui64, 1, PreviousMode) )
        goto LABEL_12;
      goto LABEL_19;
    }
  }
LABEL_12:
  v12 = v10 & 0x11F0116;
  if( (v12 || v7)
    && (RequiredPrivileges.Privilege[0].Luid = SeRestorePrivilege,
        RequiredPrivileges.PrivilegeCount = 1,
        RequiredPrivileges.Control = 1,
        RequiredPrivileges.Privilege[0].Attributes = 0,
        SePrivilegeCheck(&RequiredPrivileges, (SECURITY_SUBJECT_CONTEXT *)AccessState + 1, PreviousMode)) )
  {
    SeAppendPrivileges(AccessState, &RequiredPrivileges);
    *((_DWORD *)AccessState + 5) |= v12;
    *((_DWORD *)AccessState + 4) &= 0xFEE0FEE9;
    *((_DWORD *)AccessState + 3) |= 4u;
  }
  else if( !v5 )
  {
    *(_DWORD *)CreateOptions &= ~0x4000u;
  }
}

Referenced by: