SepExamineGlobalSaclEx

VOID __stdcall SepExamineGlobalSaclEx(
        _UNICODE_STRING *ObjectType,
        _ACL *ResourceSacl,
        VOID *Token,
        UINT64 DesiredAccess,
        _IOBJECT_TYPE_LIST *ObjectTypeList,
        UINT64 ObjectTypeListLength,
        UINT8 ReturnResultList,
        INT64 *AccessStatus,
        UINT64 *GrantedAccess,
        VOID *PrincipalSelfSid,
        UINT8 bOwner,
        UINT8 *GenerateSuccessAudit,
        UINT8 *GenerateFailureAudit){
  UINT8 *v13; 
  char v14; 
  UINT8 *v15; 
  unsigned int v16; 
  _ETHREAD *CurrentThread; 
  _ACL *v21; 
  char v22; 
  UINT64 v23; 
  char v24[8]; 
  _SEP_GLOBAL_SACL *Match; 

  v13 = GenerateSuccessAudit;
  v14 = 0;
  v15 = GenerateFailureAudit;
  v16 = DesiredAccess;
  if( GenerateSuccessAudit && !*GenerateSuccessAudit || GenerateFailureAudit && !*GenerateFailureAudit )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    Match = 0i64;
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquireResourceSharedLite((UINT64)&unk_140CEC530, 1);
    if( SepRmGlobalSaclFind(&Match, 0i64, ObjectType, 0) >= 0 )
    {
      v21 = (_ACL *)*((_QWORD *)Match + 3);
      if( v21 )
      {
        LOBYTE(GenerateSuccessAudit) = 0;
        v24[0] = 0;
        LODWORD(v23) = ObjectTypeListLength;
        SepExamineSaclEx(
          v21,
          ResourceSacl,
          Token,
          v16,
          ObjectTypeList,
          v23,
          ReturnResultList,
          AccessStatus,
          GrantedAccess,
          PrincipalSelfSid,
          bOwner,
          (UINT8 *)&GenerateSuccessAudit,
          (UINT8 *)v24);
        if( v13 )
        {
          if( *v13 || (v22 = 0, (_BYTE)GenerateSuccessAudit) )
            v22 = 1;
          *v13 = v22;
        }
        if( v15 )
        {
          if( *v15 || v24[0] )
            v14 = 1;
          *v15 = v14;
        }
      }
    }
    ExReleaseResourceLite(&unk_140CEC530);
    KeLeaveCriticalRegion();
  }
}

Referenced by: