SepDeleteAccessState
VOID __stdcall SepDeleteAccessState(ACCESS_STATE *AccessState){
__int64 v2;
void *v3;
void *v4;
void(*v5)(void);
v2 = *((_QWORD *)AccessState + 9);
if( *((_BYTE *)AccessState + 11) )
ExFreePoolWithTag(*(PVOID *)v2, 0);
v3 = (void *)*((_QWORD *)AccessState + 17);
if( v3 )
ExFreePoolWithTag(v3, 0);
v4 = (void *)*((_QWORD *)AccessState + 19);
if( v4 )
ExFreePoolWithTag(v4, 0);
if( v2 )
{
if( *(_QWORD *)(v2 + 48) )
SeDeassignSecurity((VOID **)(v2 + 48));
v5 = *(void(**)(void))(v2 + 72);
if( v5 && *(_QWORD *)(v2 + 80) )
{
if( *(_QWORD *)(v2 + 56) )
v5();
if( *(_QWORD *)(v2 + 64) )
(*(void(__fastcall **)(_QWORD))(v2 + 72))(*(_QWORD *)(v2 + 80));
}
}
}Referenced by:
CMFCheckAccess
CmpCheckKeySecurityDescriptorAccess
CmpDoAccessCheckOnKCB
NtCreateUserProcess
ObInsertObjectEx
ObOpenObjectByNameEx
ObOpenObjectByPointer
ObReferenceObjectByName
ObReferenceObjectByNameEx
PsOpenThread
PspCombineSecurityDomains
PspDeleteObjectAccessState
PspInsertThread
PspOneDirectionSecurityDomainCombine
SeDeleteAccessState
SeSubProcessToken
WmipCreateGuidObject