SepExamineGlobalSaclEx
void __fastcall SepExamineGlobalSaclEx(
const UNICODE_STRING *a1,
__int64 a2,
__int64 a3,
int a4,
__int64 a5,
unsigned int a6,
char a7,
int *a8,
_DWORD *a9,
void *a10,
char a11,
char *a12,
char *a13){
char *v13;
char v14;
char *v15;
__int64 v18;
_ETHREAD *CurrentThread;
__int64 v21;
char v22;
char v23[8];
__int64 v24;
v13 = a12;
v14 = 0;
v15 = a13;
v18 = a2;
if( a12 && !*a12 || a13 && !*a13 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v24 = 0i64;
--*((_WORD *)CurrentThread + 242);
LOBYTE(a2) = 1;
ExAcquireResourceSharedLite(&SepRmGlobalSaclLock, a2);
if( (int)SepRmGlobalSaclFind(&v24, 0i64, a1, 0) >= 0 )
{
v21 = *(_QWORD *)(v24 + 24);
if( v21 )
{
LOBYTE(a12) = 0;
v23[0] = 0;
SepExamineSaclEx(v21, v18, a3, a4, a5, a6, a7, a8, a9, a10, a11, &a12, v23);
if( v13 )
{
if( *v13 || (v22 = 0, (_BYTE)a12) )
v22 = 1;
*v13 = v22;
}
if( v15 )
{
if( *v15 || v23[0] )
v14 = 1;
*v15 = v14;
}
}
}
ExReleaseResourceLite(&SepRmGlobalSaclLock);
KeLeaveCriticalRegion();
}
}Referenced by:
SepAccessCheckAndAuditAlarmWithAdminlessChecks