SeExamineGlobalSacl

VOID __stdcall SeExamineGlobalSacl(
        _UNICODE_STRING *ObjectType,
        _ACL *ResourceSacl,
        VOID *Token,
        UINT64 DesiredAccess,
        UINT8 AccessGranted,
        UINT8 *GenerateAudit,
        UINT8 *GenerateAlarm){
  UINT8 *v7; 
  UINT8 v8; 
  unsigned int v9; 
  _ETHREAD *CurrentThread; 
  _ACL *v14; 
  char v15; 
  char v16[8]; 
  _SEP_GLOBAL_SACL *Match; 

  v7 = GenerateAudit;
  v8 = 0;
  v9 = DesiredAccess;
  if( GenerateAudit && !*GenerateAudit )
  {
    Match = 0i64;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquireResourceSharedLite((UINT64)&unk_140CEC530, 1);
    if( SepRmGlobalSaclFind(&Match, 0i64, ObjectType, 0) >= 0 )
    {
      v14 = (_ACL *)*((_QWORD *)Match + 3);
      if( v14 )
      {
        LOBYTE(GenerateAudit) = 0;
        v16[0] = 0;
        SeExamineSacl(v14, ResourceSacl, Token, v9, AccessGranted, (UINT8 *)&GenerateAudit, (UINT8 *)v16);
        if( *v7 || (v15 = 0, (_BYTE)GenerateAudit) )
          v15 = 1;
        *v7 = v15;
        if( GenerateAlarm )
        {
          if( *GenerateAlarm || v16[0] )
            v8 = 1;
          *GenerateAlarm = v8;
        }
      }
    }
    ExReleaseResourceLite(&unk_140CEC530);
    KeLeaveCriticalRegion();
  }
}

Referenced by: