SepExamineGlobalSaclEx

void __fastcall SepExamineGlobalSaclEx(
        const UNICODE_STRING *a1,
        __int64 a2,
        __int64 a3,
        int a4,
        __int64 a5,
        unsigned int a6,
        char a7,
        int *a8,
        _DWORD *a9,
        void *a10,
        char a11,
        char *a12,
        char *a13){
  char *v13; 
  char v14; 
  char *v15; 
  __int64 v18; 
  _ETHREAD *CurrentThread; 
  __int64 v21; 
  char v22; 
  char v23[8]; 
  __int64 v24; 
  v13 = a12;
  v14 = 0;
  v15 = a13;
  v18 = a2;
  if( a12 && !*a12 || a13 && !*a13 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v24 = 0i64;
    --*((_WORD *)CurrentThread + 242);
    LOBYTE(a2) = 1;
    ExAcquireResourceSharedLite(&SepRmGlobalSaclLock, a2);
    if( (int)SepRmGlobalSaclFind(&v24, 0i64, a1, 0) >= 0 )
    {
      v21 = *(_QWORD *)(v24 + 24);
      if( v21 )
      {
        LOBYTE(a12) = 0;
        v23[0] = 0;
        SepExamineSaclEx(v21, v18, a3, a4, a5, a6, a7, a8, a9, a10, a11, &a12, v23);
        if( v13 )
        {
          if( *v13 || (v22 = 0, (_BYTE)a12) )
            v22 = 1;
          *v13 = v22;
        }
        if( v15 )
        {
          if( *v15 || v23[0] )
            v14 = 1;
          *v15 = v14;
        }
      }
    }
    ExReleaseResourceLite(&SepRmGlobalSaclLock);
    KeLeaveCriticalRegion();
  }
}

Referenced by:

SepAccessCheckAndAuditAlarmWithAdminlessChecks