ObpAdjustCreatorAccessState

NTSTATUS __stdcall ObpAdjustCreatorAccessState(
        PACCESS_STATE AccessState,
        _KPROCESSOR_MODE AccessMode,
        _OBJECT_TYPE *ObjectType,
        VOID *Object){
  unsigned int *v4; 
  unsigned int v5; 
  INT8 v8; 
  VOID *v10; 
  PRIVILEGE_SET RequiredPrivileges; 

  v4 = (unsigned int *)((char *)AccessState + 16);
  v5 = *((_DWORD *)AccessState + 4);
  v8 = AccessMode;
  memset(&RequiredPrivileges, 0, sizeof(RequiredPrivileges));
  if( (v5 & 0x2000000) != 0 )
  {
    v5 = v5 & 0xEDFFFFFF | 0x10000000;
    *v4 = v5;
  }
  if( (v5 & 0xF0000000) != 0 )
  {
    RtlMapGenericMask((UINT64 *)AccessState + 2, &ObjectType->TypeInfo.GenericMapping);
    v5 = *((_DWORD *)AccessState + 4);
  }
  if( (v5 & 0x1000000) != 0 )
  {
    RequiredPrivileges.Privilege[0].Attributes = 0;
    RequiredPrivileges.Privilege[0].Luid = SeSecurityPrivilege;
    RequiredPrivileges.PrivilegeCount = 1;
    RequiredPrivileges.Control = 1;
    if( !SePrivilegeCheck((UINT64 *)&RequiredPrivileges.PrivilegeCount, (INT64)AccessState + 32, v8) )
    {
      SePrivilegedServiceAuditAlarm(0i64, (_SECURITY_SUBJECT_CONTEXT *)AccessState + 1, &RequiredPrivileges, 0);
      return -1073741727;
    }
    *v4 &= ~0x1000000u;
    *((_DWORD *)AccessState + 5) |= 0x1000000u;
    SeAppendPrivileges(AccessState, &RequiredPrivileges);
    v5 = *((_DWORD *)AccessState + 4);
  }
  *((_DWORD *)AccessState + 5) |= v5;
  *v4 = 0;
  *((_DWORD *)AccessState + 5) &= ObjectType->TypeInfo.ValidAccessMask | 0x1000000;
  v10 = ObpReferenceSecurityDescriptor((_OBJECT_HEADER *)((char *)Object - 48));
  *((_DWORD *)AccessState + 5) &= ~(unsigned int)SeComputeCreatorDeniedRights(
                                                   (_SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
                                                   AccessState,
                                                   *((unsigned int *)AccessState + 5),
                                                   v10);
  if( v10 )
    ObDereferenceSecurityDescriptor(v10, 1ui64);
  return 0;
}

Referenced by: