CmpSetAccessStateForBackupRestore
__int64 __fastcall CmpSetAccessStateForBackupRestore(INT64 a1, char a2, VOID *a3, char a4){
VOID *v4;
_KPROCESSOR_MODE v8;
INT8 v9;
int v10;
*(_DWORD *)(a1 + 20) = 0;
v4 = a3;
LOBYTE(a3) = a2;
if( SeSinglePrivilegeCheckEx(SeBackupPrivilege, (_SECURITY_SUBJECT_CONTEXT *)(a1 + 32), (_KPROCESSOR_MODE)a3) )
{
*(_DWORD *)(a1 + 12) |= 2u;
*(_DWORD *)(a1 + 20) |= 0x1020019u;
}
LOBYTE(v8) = a2;
v9 = SeSinglePrivilegeCheckEx(SeRestorePrivilege, (_SECURITY_SUBJECT_CONTEXT *)(a1 + 32), v8);
v10 = *(_DWORD *)(a1 + 20);
if( v9 )
{
*(_DWORD *)(a1 + 12) |= 4u;
v10 |= 0x10F0006u;
*(_DWORD *)(a1 + 20) = v10;
}
if( a4 )
*(_DWORD *)(a1 + 24) = v10;
if( !v10 )
return 3221225506i64;
SepAdjustAccessStateForConstraints((INT64)CmKeyObjectType, v4, 1, a1);
*(_DWORD *)(a1 + 16) = ~*(_DWORD *)(a1 + 20) & *(_DWORD *)(a1 + 24);
return 0i64;
}Referenced by:
CmpCheckCreateAccessOnKcbStack
CmpCheckKeySecurityDescriptorAccess
CmpCheckOpenAccessOnKeyBody