CmpExamineSaclForAuditEvent

__int64 __fastcall CmpExamineSaclForAuditEvent(void *a1, __int64 *a2, _BYTE *a3){
  NTSTATUS SaclSecurityDescriptor; 
  VOID *v6; 
  VOID *v7; 
  unsigned __int8 SaclPresent; 
  char SaclDefaulted[7]; 
  PACL Sacl; 
  _UNICODE_STRING DestinationString; 
  UINT8 GenerateAudit; 
  UINT8 GenerateAlarm; 

  Sacl = 0i64;
  *a3 = 0;
  GenerateAudit = 0;
  GenerateAlarm = 0;
  SaclPresent = 0;
  DestinationString = 0i64;
  SaclSecurityDescriptor = RtlGetSaclSecurityDescriptor(a1, &SaclPresent, &Sacl, (UINT8 *)SaclDefaulted);
  if( SaclSecurityDescriptor >= 0 )
  {
    if( SaclPresent )
    {
      v6 = (VOID *)CmpEffectiveTokenForSubject(a2, 0i64);
      SeExamineSacl(Sacl, Sacl, v6, 0xF003Fui64, 1u, &GenerateAudit, &GenerateAlarm);
    }
    RtlInitUnicodeString(&DestinationString, L"Key");
    v7 = (VOID *)CmpEffectiveTokenForSubject(a2, 0i64);
    SeExamineGlobalSacl(&DestinationString, Sacl, v7, 0xF003Fui64, 1u, &GenerateAudit, &GenerateAlarm);
    if( GenerateAudit || GenerateAlarm )
      *a3 = 1;
  }
  return(unsigned int)SaclSecurityDescriptor;
}

Referenced by: