SeComputeCreatorDeniedRights

UINT64 __stdcall SeComputeCreatorDeniedRights(
        _SECURITY_SUBJECT_CONTEXT *Context,
        _ACCESS_STATE *AccessState,
        UINT64 CurrentAccess,
        VOID *ObjectSecurityDescriptor){
  int v5; 
  unsigned int v7; 
  __int64 v9; 
  __int16 v10; 
  __int64 v11; 
  _ACL *v12; 
  UINT8 v13; 
  __int64 v14; 
  _ACL *v15; 
  void *ClientToken; 
  VOID *ScopedPolicySid; 
  NTSTATUS Cap; 
  _RTL_DYNAMIC_HASH_TABLE_ENTRY *v19; 
  _KPROCESSOR_MODE AccessMode; 
  unsigned int GrantedAccess; 
  _RTL_DYNAMIC_HASH_TABLE_ENTRY *a2; 
  int AccessStatus; 

  AccessStatus = 0;
  v5 = CurrentAccess;
  GrantedAccess = 0;
  v7 = 0;
  if( (CurrentAccess & 0xC0000) == 0 )
    return 0i64;
  v9 = *((_QWORD *)AccessState + 9);
  if( *(_QWORD *)(v9 + 48) )
    ObjectSecurityDescriptor = *(VOID **)(v9 + 48);
  if( !ObjectSecurityDescriptor )
  {
    ObjectSecurityDescriptor = (VOID *)*((_QWORD *)AccessState + 8);
    if( !ObjectSecurityDescriptor )
      return 0i64;
  }
  v10 = *((_WORD *)ObjectSecurityDescriptor + 1);
  if( (v10 & 4) != 0 )
  {
    if( v10 >= 0 )
    {
      v12 = (_ACL *)*((_QWORD *)ObjectSecurityDescriptor + 4);
    }
    else
    {
      v11 = *((unsigned int *)ObjectSecurityDescriptor + 4);
      v12 = (_DWORD)v11 ? (_ACL *)((char *)ObjectSecurityDescriptor + v11) : 0i64;
    }
  }
  else
  {
    v12 = 0i64;
  }
  if( !RtlpOwnerAcesPresent(0, v12) )
  {
    if( (v10 & 0x10) != 0 )
    {
      if( v10 >= 0 )
      {
        v15 = (_ACL *)*((_QWORD *)ObjectSecurityDescriptor + 3);
      }
      else
      {
        v14 = *((unsigned int *)ObjectSecurityDescriptor + 3);
        v15 = (_DWORD)v14 ? (_ACL *)((char *)ObjectSecurityDescriptor + v14) : 0i64;
      }
    }
    else
    {
      v15 = 0i64;
    }
    a2 = 0i64;
    if( !SepRmEnforceCap )
      return 0i64;
    if( !v15 )
      return 0i64;
    ScopedPolicySid = SepGetScopedPolicySid(v15);
    if( !ScopedPolicySid )
      return 0i64;
    Cap = SepRmReferenceFindCap(ScopedPolicySid, (_SEP_CENTRALIZED_ACCESS_POLICY **)&a2);
    v19 = a2;
    if( Cap < 0 )
      v19 = (_RTL_DYNAMIC_HASH_TABLE_ENTRY *)SepRmDefaultCap;
    if( ((__int64)v19[2].Linkage.Blink & 1) == 0 )
      return 0i64;
  }
  ClientToken = Context->ClientToken;
  if( !Context->ClientToken )
    ClientToken = Context->PrimaryToken;
  if( !SepTokenIsOwner(ClientToken, ObjectSecurityDescriptor, v13) )
    return 0i64;
  if( (v5 & 0x40000) != 0 )
  {
    LOBYTE(AccessMode) = KeGetCurrentThread()->PreviousMode;
    if( !(unsigned __int8)SeAccessCheck(
                             ObjectSecurityDescriptor,
                             Context,
                             1u,
                             0x40000,
                             0,
                             0i64,
                             (PGENERIC_MAPPING)&StandardBitMapping,
                             AccessMode,
                             &GrantedAccess,
                             &AccessStatus) )
      v7 = 0x40000;
  }
  if( (v5 & 0x80000) != 0 )
  {
    LOBYTE(AccessMode) = KeGetCurrentThread()->PreviousMode;
    if( !(unsigned __int8)SeAccessCheck(
                             ObjectSecurityDescriptor,
                             Context,
                             1u,
                             0x80000,
                             0,
                             0i64,
                             (PGENERIC_MAPPING)&StandardBitMapping,
                             AccessMode,
                             &GrantedAccess,
                             &AccessStatus) )
      v7 |= 0x80000u;
  }
  return v7;
}

Referenced by: