EtwpAccessCheck

NTSTATUS __stdcall EtwpAccessCheck(
        VOID *SecurityDescriptor,
        UINT64 DesiredAccess,
        _SECURITY_SUBJECT_CONTEXT *UserSecurityContext){
  _ACCESS_MASK v4; 
  _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  _KPROCESSOR_MODE AccessMode; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  int AccessStatus; 
  unsigned int GrantedAccess; 

  AccessStatus = 0;
  GrantedAccess = 0;
  v4 = DesiredAccess;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( !UserSecurityContext )
    SeCaptureSubjectContext((INT64)&SubjectContext);
  p_SubjectContext = &SubjectContext;
  if( UserSecurityContext )
    p_SubjectContext = UserSecurityContext;
  LOBYTE(AccessMode) = 1;
  SeAccessCheck(
    SecurityDescriptor,
    p_SubjectContext,
    0,
    v4,
    0,
    0i64,
    (PGENERIC_MAPPING)&EtwpGenericMapping,
    AccessMode,
    &GrantedAccess,
    &AccessStatus);
  if( !UserSecurityContext )
    SeReleaseSubjectContext(&SubjectContext);
  return AccessStatus;
}

Referenced by: