SeCheckForCriticalAceRemoval

INT8 __fastcall SeCheckForCriticalAceRemoval(UINT8 *a1, UINT8 *a2, INT64 *a3, _BYTE *r9_0){
  NTSTATUS AllocatedFullProcessImageName; 
  _EPROCESS *CurrentThreadProcess; 
  int v7; 
  __int64 v8; 
  char a4; 
  char a5[15]; 
  _EVENT_DATA_DESCRIPTOR v12; 
  int *v13; 
  int v14; 
  int v15; 
  __int64 v16; 
  int v17[2]; 

  *(_QWORD *)&a5[7] = 0i64;
  a4 = 0;
  a5[0] = 0;
  LOBYTE(AllocatedFullProcessImageName) = SepCheckForCriticalAceRemoval(
                                            a1,
                                            a2,
                                            (_SECURITY_SUBJECT_CONTEXT *)a3,
                                            &a4,
                                            (INT64)a5);
  if( a4 )
  {
    if( !a5[0] )
    {
      CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
      AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(
                                        CurrentThreadProcess,
                                        (_UNICODE_STRING **)&a5[7]);
      if( AllocatedFullProcessImageName >= 0 && *(&stru_140C00F40 + 1788) > 5u )
      {
        LOBYTE(AllocatedFullProcessImageName) = tlgKeywordOn((__int64)&stru_140C00F40 + 7152, 0x200000000000i64);
        if( (_BYTE)AllocatedFullProcessImageName )
        {
          v7 = (unsigned __int16)**(_WORD **)&a5[7];
          v8 = *(_QWORD *)(*(_QWORD *)&a5[7] + 8i64);
          v15 = 0;
          v17[1] = 0;
          v13 = v17;
          v16 = v8;
          v17[0] = v7;
          v14 = 2;
          LOBYTE(AllocatedFullProcessImageName) = tlgWriteTransfer_EtwWriteTransfer(
                                                    (__int64)&stru_140C00F40 + 7152,
                                                    (unsigned __int8 *)word_14002B3A2,
                                                    0i64,
                                                    0i64,
                                                    4u,
                                                    &v12);
        }
      }
    }
  }
  *r9_0 = 0;
  return AllocatedFullProcessImageName;
}

Referenced by: