CmpCheckCreateAccess

UINT8 __stdcall CmpCheckCreateAccess(
        VOID *Descriptor,
        ACCESS_STATE *AccessState,
        INT8 PreviousMode,
        UINT64 AdditionalAccess,
        INT64 *AccessStatus){
  _DWORD *v5; 
  int v6; 
  UINT8 v7; 
  _KPROCESSOR_MODE AccessMode; 
  unsigned int v10; 
  int v11; 
  INT64 v12; 

  v11 = HIDWORD(Descriptor);
  v5 = (_DWORD *)v12;
  v6 = PreviousMode + 32;
  v10 = 0;
  LOBYTE(AccessMode) = AdditionalAccess;
  v7 = (unsigned __int8)SeAccessCheck(
                          AccessState,
                          (PSECURITY_SUBJECT_CONTEXT)(PreviousMode + 32i64),
                          0,
                          (unsigned int)AccessStatus | 4,
                          0,
                          0i64,
                          (PGENERIC_MAPPING)((char *)CmKeyObjectType + 76),
                          AccessMode,
                          &v10,
                          (PNTSTATUS)v12);
  if( v7
    && ((unsigned __int8)AccessStatus & 0x20) != 0
    && (unsigned __int8)RtlIsSandboxedToken((_KNOWN_CONTROLLER_TYPE)v6) )
  {
    v7 = 0;
    *v5 = -1073741790;
  }
  return v7;
}

Referenced by: