PspGetNoChildProcessRestrictedPolicy

__int64 __fastcall PspGetNoChildProcessRestrictedPolicy(__int64 a1){
  struct DMA_ADAPTER *v2; 
  unsigned __int8 Enforced; 
  unsigned __int8 UnlessSecure; 
  unsigned __int8 AuditOnly; 
  Enforced = 0;
  UnlessSecure = 0;
  AuditOnly = 0;
  v2 = (struct DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)a1);
  SeTokenGetNoChildProcessRestricted(v2, &Enforced, &UnlessSecure, &AuditOnly);
  ObFastDereferenceObject((INT64 *)(a1 + 1208), v2);
  if( Enforced )
    return(unsigned int)(UnlessSecure != 0) + 1;
  else
    return AuditOnly != 0 ? 3 : 0;
}

Referenced by: