SepCheckForCriticalAceRemoval

INT8 __stdcall SepCheckForCriticalAceRemoval(
        VOID *SecurityDescriptor,
        VOID *a2,
        _SECURITY_SUBJECT_CONTEXT *a3,
        _BYTE *a4,
        INT64 a5){
  void **v5; 
  _SECURITY_SUBJECT_CONTEXT *v7; 
  _SECURITY_SUBJECT_CONTEXT *v10; 
  VOID *ClientToken; 
  void *retaddr; 

  v5 = &retaddr;
  v7 = a3;
  if( a4 )
    *a4 = 0;
  if( a5 )
    *(_BYTE *)a5 = 0;
  if( !SepAllowAllApplicationAceRemoval )
  {
    v10 = a3;
    LOBYTE(a3) = KeGetCurrentThread()->PreviousMode;
    LOBYTE(v5) = SeSinglePrivilegeCheckEx(SeTcbPrivilege, v10, (_KPROCESSOR_MODE)a3);
    if( !(_BYTE)v5 )
    {
      ClientToken = v7->ClientToken;
      if( !v7->ClientToken )
        ClientToken = v7->PrimaryToken;
      LOBYTE(v5) = SepSidInToken(ClientToken, 0i64, SeTrustedInstallerSid, 0, 0, 0);
      if( !(_BYTE)v5 )
        LOBYTE(v5) = SepHasCriticalAcesRemoved(SecurityDescriptor, a2, a4, (_BYTE *)a5);
    }
  }
  return(char)v5;
}

Referenced by: