ExIsRestrictedCaller

UINT64 __stdcall ExIsRestrictedCaller(INT8 PreviousMode){
  unsigned __int8 v1; 
  UINT64 result; 
  _KPROCESSOR_MODE AccessMode; 
  _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; 
  int AccessStatus; 
  unsigned int GrantedAccess; 

  AccessStatus = 0;
  GrantedAccess = 0;
  memset(&SubjectSecurityContext, 0, sizeof(SubjectSecurityContext));
  result = 0;
  if( PreviousMode )
  {
    SeCaptureSubjectContext((INT64)&SubjectSecurityContext);
    LOBYTE(AccessMode) = 1;
    v1 = (unsigned __int8)SeAccessCheck(
                            SeMediumDaclSd,
                            &SubjectSecurityContext,
                            0,
                            0x20000,
                            0,
                            0i64,
                            (PGENERIC_MAPPING)&ExpRestrictedGenericMapping,
                            AccessMode,
                            &GrantedAccess,
                            &AccessStatus);
    SeReleaseSubjectContext(&SubjectSecurityContext);
    if( !v1 || AccessStatus < 0 )
      return 1;
  }
  return result;
}

Referenced by: