ObpCheckObjectReference

UINT8 __stdcall ObpCheckObjectReference(
        PVOID Object,
        _ACCESS_STATE *AccessState,
        UINT8 TypeMutexLocked,
        CHAR AccessMode,
        INT64 *AccessStatus){
  unsigned __int64 v7; 
  __int64 v9; 
  NTSTATUS ObjectSecurity; 
  GENERIC_MAPPING *GenericMapping; 
  VOID *v12; 
  _LUID *v13; 
  UINT8 v14; 
  int v15; 
  UINT64 PreviouslyGrantedAccess; 
  UINT64 PreviouslyGrantedAccessa; 
  _PRIVILEGE_SET *Privileges; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  PPRIVILEGE_SET v21; 
  UINT64 GrantedAccess; 
  BOOLEAN MemoryAllocated; 
  MemoryAllocated = TypeMutexLocked;
  LODWORD(GrantedAccess) = 0;
  v21 = 0i64;
  SecurityDescriptor = 0i64;
  v7 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  MemoryAllocated = 0;
  v9 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v7];
  ObjectSecurity = ObpGetObjectSecurity(Object, &SecurityDescriptor, &MemoryAllocated, AccessMode);
  if( ObjectSecurity < 0 )
  {
    *(_DWORD *)AccessStatus = ObjectSecurity;
    return 0;
  }
  else
  {
    SeLockSubjectContext((_SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
    GenericMapping = (GENERIC_MAPPING *)(v9 + 76);
    v12 = SecurityDescriptor;
    LODWORD(PreviouslyGrantedAccess) = *((_DWORD *)AccessState + 5);
    v14 = SeAccessCheck(
            SecurityDescriptor,
            (SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
            1u,
            *((unsigned int *)AccessState + 4),
            PreviouslyGrantedAccess,
            &v21,
            GenericMapping,
            AccessMode,
            &GrantedAccess,
            AccessStatus);
    if( v14 )
    {
      v15 = GrantedAccess;
      *((_DWORD *)AccessState + 5) |= GrantedAccess;
      v13 = (_LUID *)(unsigned int)~v15;
      *((_DWORD *)AccessState + 4) &= (unsigned int)v13;
    }
    if( v12 )
    {
      LODWORD(PreviouslyGrantedAccessa) = *((_DWORD *)AccessState + 4) | *((_DWORD *)AccessState + 5);
      SeObjectReferenceAuditAlarm(
        v13,
        Object,
        v12,
        (_SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
        PreviouslyGrantedAccessa,
        Privileges,
        v14,
        AccessMode);
    }
    SeUnlockSubjectContext((SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
    ObReleaseObjectSecurity(v12, MemoryAllocated);
    return v14;
  }
}

Referenced by: