ObpAdjustCreatorAccessState

__int64 __fastcall ObpAdjustCreatorAccessState(PACCESS_STATE AccessState, KPROCESSOR_MODE a2, __int64 a3, __int64 a4){
  unsigned int *v4; 
  unsigned int v5; 
  volatile INT64 *v10; 
  struct _PRIVILEGE_SET RequiredPrivileges; 
  v4 = (unsigned int *)((char *)AccessState + 16);
  v5 = *((_DWORD *)AccessState + 4);
  memset(&RequiredPrivileges, 0, sizeof(RequiredPrivileges));
  if( (v5 & 0x2000000) != 0 )
  {
    v5 = v5 & 0xEDFFFFFF | 0x10000000;
    *v4 = v5;
  }
  if( (v5 & 0xF0000000) != 0 )
  {
    RtlMapGenericMask((UINT64 *)AccessState + 2, (_GENERIC_MAPPING *)(a3 + 76));
    v5 = *((_DWORD *)AccessState + 4);
  }
  if( (v5 & 0x1000000) != 0 )
  {
    RequiredPrivileges.Privilege[0].Attributes = 0;
    RequiredPrivileges.Privilege[0].Luid = *(_LUID *)SeSecurityPrivilege;
    RequiredPrivileges.PrivilegeCount = 1;
    RequiredPrivileges.Control = 1;
    if( !SePrivilegeCheck(&RequiredPrivileges, (SECURITY_SUBJECT_CONTEXT *)AccessState + 1, a2) )
    {
      SePrivilegedServiceAuditAlarm(0i64, (SECURITY_SUBJECT_CONTEXT *)AccessState + 1, &RequiredPrivileges, 0i64);
      return 3221225569i64;
    }
    *v4 &= ~0x1000000u;
    *((_DWORD *)AccessState + 5) |= 0x1000000u;
    SeAppendPrivileges(AccessState, &RequiredPrivileges);
    v5 = *((_DWORD *)AccessState + 4);
  }
  *((_DWORD *)AccessState + 5) |= v5;
  *v4 = 0;
  *((_DWORD *)AccessState + 5) &= *(_DWORD *)(a3 + 92) | 0x1000000;
  v10 = ObpReferenceSecurityDescriptor(a4 - 48);
  *((_DWORD *)AccessState + 5) &= ~(unsigned int)SeComputeCreatorDeniedRights(
                                                   (SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
                                                   AccessState,
                                                   *((unsigned int *)AccessState + 5),
                                                   (PVOID)v10);
  if( v10 )
    ObDereferenceSecurityDescriptor((PVOID)v10, 1ui64);
  return 0i64;
}

Referenced by: