RtlpAllowsLowBoxAccess

UINT8 __stdcall RtlpAllowsLowBoxAccess(_RTL_ATOM_TABLE_ENTRY *AtomEntry){
  UINT8 result; 
  bool v3; 
  UINT8 v4; 
  __int64 v5; 
  VOID **PoolWithTag; 
  WCHAR *v7; 
  const wchar_t *v8; 
  BOOL v9; 
  UINT64 DesiredAccess; 
  UINT64 v11; 
  char EffectiveOnly[4]; 
  UINT64 GrantedAccess; 
  _UNICODE_STRING v14; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; 
  _TOKEN_TYPE TokenType; 
  PRIVILEGE_SET *Privileges; 
  _UNICODE_STRING DestinationString; 
  _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; 
  _LEARNING_MODE_OBJECT_INFORMATION ObjectInformation[4]; 
  __int128 v21; 
  __int128 v22; 
  __int64 v23; 
  _GENERIC_MAPPING GenericMapping; 
  char v25; 

  GrantedAccess = 0i64;
  result = 0;
  SubjectSecurityContext.ClientToken = 0i64;
  *(_QWORD *)&SubjectSecurityContext.ImpersonationLevel = 0i64;
  v3 = (AtomEntry->Reference.Flags & 2) == 0;
  EffectiveOnly[0] = 0;
  GenericMapping.GenericRead = 0x20000;
  GenericMapping.GenericWrite = 196608;
  GenericMapping.GenericExecute = 0x20000;
  GenericMapping.GenericAll = 2031616;
  *(_OWORD *)ObjectInformation = 0i64;
  v23 = 0i64;
  v21 = 0i64;
  v22 = 0i64;
  DestinationString = 0i64;
  v14 = 0i64;
  if( !v3 )
    return 1;
  if( byte_140C5424C )
  {
    RtlInitUnicodeString(&DestinationString, L"Global Atom Table Entry");
    v4 = 1;
    v5 = 2i64 * AtomEntry->NameLength + 2;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v5, 1833858113i64);
    v7 = (WCHAR *)PoolWithTag;
    if( PoolWithTag )
    {
      memset(PoolWithTag, 0i64, v5);
      if( RtlStringCbCopyW(v7, v5, AtomEntry->Name) < 0 )
        v8 = L"Unable to capture ATOM name.";
      else
        v8 = v7;
    }
    else
    {
      v8 = L"Unable to Allocate space for ATOM name.";
    }
    RtlInitUnicodeString(&v14, v8);
    *(_QWORD *)&v21 = &DestinationString;
    *((_QWORD *)&v21 + 1) = &v14;
    SeSetLearningModeObjectInformation(ObjectInformation);
    Privileges = (PRIVILEGE_SET *)&v25;
    SubjectSecurityContext.PrimaryToken = PsReferenceEffectiveToken(
                                            (_ETHREAD *)KeGetCurrentThread(),
                                            &TokenType,
                                            (UINT8 *)EffectiveOnly,
                                            &ImpersonationLevel,
                                            0i64);
    SubjectSecurityContext.ProcessAuditId = KeGetCurrentThread()->ApcState.Process->UniqueProcessId;
    LODWORD(v11) = 0;
    LODWORD(DesiredAccess) = 0x20000;
    v9 = SeAccessCheckWithHint(
           SeAtomSd,
           0i64,
           &SubjectSecurityContext,
           0i64,
           DesiredAccess,
           v11,
           &Privileges,
           &GenericMapping,
           KeGetCurrentThread()->PreviousMode,
           &GrantedAccess,
           (INT64 *)((char *)&GrantedAccess + 4));
    ObfDereferenceObjectWithTag(SubjectSecurityContext.PrimaryToken, 0x746C6644ui64);
    if( v7 )
      ExFreePoolWithTag(v7, 0x6D4E7441u);
    SeClearLearningModeObjectInformation();
    if( !v9 || !(_DWORD)GrantedAccess )
      return 0;
    return v4;
  }
  return result;
}

Referenced by: