CmpCheckKeyBodyAccess

UINT8 __stdcall CmpCheckKeyBodyAccess(
        CM_KEY_BODY *KeyBody,
        CM_TRANS *CmTrans,
        ACCESS_STATE *AccessState,
        INT8 AccessMode,
        INT64 *AccessStatus){
  INT64 v9; 
  int v10; 
  _LIST_ENTRY *v11; 
  UINT8 v12; 
  unsigned int v13; 
  _UNICODE_STRING *v14; 
  _KPROCESSOR_MODE AccessModea; 
  int started; 
  unsigned int GrantedAccess; 
  PPRIVILEGE_SET Privileges; 
  INT64 v20[2]; 
  PPRIVILEGE_SET v21[2]; 

  GrantedAccess = 0;
  Privileges = 0i64;
  *(_OWORD *)v20 = 0i64;
  WORD1(v20[0]) = -1;
  *(_OWORD *)v21 = 0i64;
  if( CmpIsKeyDeletedForKeyBody(KeyBody, CmTrans) )
  {
    v10 = -1073741444;
    started = -1073741444;
    goto LABEL_13;
  }
  started = CmpStartKcbStackForTopLayerKcb((INT64)v20, (INT64)KeyBody->KeyControlBlock);
  v10 = started;
  if( started < 0 )
  {
LABEL_13:
    v12 = 0;
    goto LABEL_10;
  }
  v11 = CmpGetSecurityCacheEntryForKcbStack((INT64)v20, (INT64)CmTrans, v9) + 2;
  SeLockSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
  LOBYTE(AccessModea) = AccessMode;
  v12 = (unsigned __int8)SeAccessCheck(
                           v11,
                           (PSECURITY_SUBJECT_CONTEXT)AccessState + 1,
                           1u,
                           *((_DWORD *)AccessState + 4),
                           *((_DWORD *)AccessState + 5),
                           &Privileges,
                           (PGENERIC_MAPPING)((char *)CmKeyObjectType + 76),
                           AccessModea,
                           &GrantedAccess,
                           &started);
  if( Privileges )
  {
    SeAppendPrivileges(AccessState, Privileges);
    CmSiFreeMemory(Privileges);
  }
  if( v12 )
  {
    v13 = GrantedAccess;
    *((_DWORD *)AccessState + 5) |= GrantedAccess;
    *((_DWORD *)AccessState + 4) &= ~(v13 | 0x2000000);
  }
  *((_WORD *)KeyBody + 24) |= 2u;
  v14 = (_UNICODE_STRING *)(CmKeyObjectType + 2);
  if( CmTrans )
    SeOpenObjectAuditAlarmWithTransaction(
      v14,
      KeyBody,
      0i64,
      v11,
      AccessState,
      0,
      v12,
      AccessMode,
      &CmTrans->KtmUow,
      (UINT8 *)AccessState + 10);
  else
    SeOpenObjectAuditAlarm(v14, KeyBody, 0i64, v11, AccessState, 0, v12, AccessMode, (UINT8 *)AccessState + 10);
  *((_WORD *)KeyBody + 24) &= ~2u;
  SeUnlockSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
  v10 = started;
LABEL_10:
  if( v21[1] )
  {
    CmSiFreeMemory(v21[1]);
    v10 = started;
  }
  *(_DWORD *)AccessStatus = v10;
  return v12;
}

Referenced by: