SepRmGlobalSaclFind
__int64 __fastcall SepRmGlobalSaclFind(__int64 *a1, __int64 **a2, const UNICODE_STRING *a3, char a4){
char v4;
__int64 **v6;
unsigned int v8;
_ETHREAD *CurrentThread;
__int64 v10;
__int64 *v11;
v4 = 0;
v6 = a2;
v8 = -1073741772;
if( SepRmGlobalSaclHead )
{
if( a4 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v4 = 1;
LOBYTE(a2) = 1;
ExAcquireResourceSharedLite(&SepRmGlobalSaclLock, (BOOL)a2);
}
v10 = SepRmGlobalSaclHead;
*a1 = SepRmGlobalSaclHead;
if( v6 )
*v6 = 0i64;
while( v10 )
{
if( !(unsigned int)RtlCompareUnicodeString(a3, (const UNICODE_STRING *)(v10 + 8), 0) )
{
v8 = 0;
goto LABEL_13;
}
v11 = (__int64 *)*a1;
if( v6 )
*v6 = v11;
v10 = *v11;
*a1 = v10;
}
if( v6 )
*v6 = 0i64;
LABEL_13:
if( v4 )
{
ExReleaseResourceLite(&SepRmGlobalSaclLock);
KeLeaveCriticalRegion();
}
}
return v8;
}Referenced by:
NtSetSecurityObject
SeAuditingFileOrGlobalEvents
SeExamineGlobalSacl
SeMaximumAuditMaskFromGlobalSacl
SepExamineGlobalSaclEx
SepRmGlobalSaclSetWrkr