SepRmGlobalSaclFind

__int64 __fastcall SepRmGlobalSaclFind(__int64 *a1, __int64 **a2, const UNICODE_STRING *a3, char a4){
  char v4; 
  __int64 **v6; 
  unsigned int v8; 
  _ETHREAD *CurrentThread; 
  __int64 v10; 
  __int64 *v11; 
  v4 = 0;
  v6 = a2;
  v8 = -1073741772;
  if( SepRmGlobalSaclHead )
  {
    if( a4 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      v4 = 1;
      LOBYTE(a2) = 1;
      ExAcquireResourceSharedLite(&SepRmGlobalSaclLock, (BOOL)a2);
    }
    v10 = SepRmGlobalSaclHead;
    *a1 = SepRmGlobalSaclHead;
    if( v6 )
      *v6 = 0i64;
    while( v10 )
    {
      if( !(unsigned int)RtlCompareUnicodeString(a3, (const UNICODE_STRING *)(v10 + 8), 0) )
      {
        v8 = 0;
        goto LABEL_13;
      }
      v11 = (__int64 *)*a1;
      if( v6 )
        *v6 = v11;
      v10 = *v11;
      *a1 = v10;
    }
    if( v6 )
      *v6 = 0i64;
LABEL_13:
    if( v4 )
    {
      ExReleaseResourceLite(&SepRmGlobalSaclLock);
      KeLeaveCriticalRegion();
    }
  }
  return v8;
}

Referenced by:

NtSetSecurityObject
SeAuditingFileOrGlobalEvents
SeExamineGlobalSacl
SeMaximumAuditMaskFromGlobalSacl
SepExamineGlobalSaclEx
SepRmGlobalSaclSetWrkr