ObQuerySecurityObject
NTSTATUS __stdcall ObQuerySecurityObject(
VOID *Object,
UINT64 SecurityInformation,
VOID *SecurityDescriptor,
UINT64 Length,
UINT64 *LengthNeeded){
__int64 v5;
NTSTATUS result;
char v7;
int v8;
int v9;
v9 = Length;
v8 = SecurityInformation;
v7 = 0;
v5 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
result = (*(__int64(__fastcall **)(VOID *, __int64, int *, VOID *, int *, char *, _DWORD, __int64, char))(v5 + 152))(
Object,
1i64,
&v8,
SecurityDescriptor,
&v9,
(char *)Object - 8,
*(_DWORD *)(v5 + 100),
v5 + 76,
v7);
*(_DWORD *)LengthNeeded = v9;
return result;
}Referenced by:
CmpCheckExeOwnerForPca
RtlIsUntrustedObject
SepMandatorySubProcessToken
SepVerifyDesktopAppxImage