WdipAccessCheck

NTSTATUS __stdcall WdipAccessCheck(){
  VOID **v0; 
  unsigned int v1; 
  VOID **PoolWithTag; 
  VOID **v3; 
  unsigned __int8 *v5; 
  unsigned int v6; 
  VOID **v7; 
  _ACL *v8; 
  UINT64 v9; 
  _KPROCESSOR_MODE AccessMode; 
  int AccessStatus; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  unsigned int GrantedAccess; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _GENERIC_MAPPING GenericMapping; 

  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  v0 = 0i64;
  GenericMapping.GenericRead = 131073;
  GrantedAccess = 0;
  GenericMapping.GenericWrite = 0x20000;
  GenericMapping.GenericExecute = 0x20000;
  GenericMapping.GenericAll = 2031617;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v1 = RtlLengthRequiredSid(6ui64);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v1, 1934181463i64);
  v3 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  AccessStatus = RtlInitializeSid(PoolWithTag, &IdentifierAuthority, 6u);
  if( AccessStatus >= 0 )
  {
    v5 = (unsigned __int8 *)SeLocalSystemSid;
    *((_DWORD *)v3 + 2) = 80;
    *((_DWORD *)v3 + 3) = -1324354722;
    *((_DWORD *)v3 + 4) = 78537857;
    *((_DWORD *)v3 + 5) = 698502321;
    *((_DWORD *)v3 + 6) = 558674196;
    *((_DWORD *)v3 + 7) = 1451644582;
    v6 = 4 * (*((unsigned __int8 *)v3 + 1) + *((unsigned __int8 *)SeAliasAdminsSid + 1) + v5[1]) + 108;
    v7 = ExAllocatePoolWithTag(1ui64, v6, 1934181463i64);
    v0 = v7;
    if( v7 )
    {
      v8 = (_ACL *)(v7 + 5);
      AccessStatus = RtlCreateSecurityDescriptor(v7, 1ui64);
      if( AccessStatus >= 0 )
      {
        AccessStatus = RtlCreateAcl(v8, (_ACL)(v6 - 40), 2ui64, v9);
        if( AccessStatus >= 0 )
        {
          AccessStatus = RtlAddAccessAllowedAce(v8, 2ui64, 1, SeAliasAdminsSid);
          if( AccessStatus >= 0 )
          {
            AccessStatus = RtlAddAccessAllowedAce(v8, 2ui64, 1, SeLocalSystemSid);
            if( AccessStatus >= 0 )
            {
              AccessStatus = RtlAddAccessAllowedAce(v8, 2ui64, 1, v3);
              if( AccessStatus >= 0 )
              {
                AccessStatus = RtlSetDaclSecurityDescriptor(v0, 1u, v8, 0);
                if( AccessStatus >= 0 )
                {
                  SeCaptureSubjectContext((INT64)&SubjectContext);
                  LOBYTE(AccessMode) = 1;
                  SeAccessCheck(
                    v0,
                    &SubjectContext,
                    0,
                    1,
                    0,
                    0i64,
                    &GenericMapping,
                    AccessMode,
                    &GrantedAccess,
                    &AccessStatus);
                  SeReleaseSubjectContext(&SubjectContext);
                }
              }
            }
          }
        }
      }
    }
    else
    {
      AccessStatus = -1073741670;
    }
  }
  ExFreePoolWithTag(v3, 0);
  if( v0 )
    ExFreePoolWithTag(v0, 0);
  return AccessStatus;
}

Referenced by: