ExIsRestrictedCaller

UINT64 __stdcall ExIsRestrictedCaller(INT8 PreviousMode){
  bool v1; 
  UINT64 result; 
  UINT64 v3; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; 
  INT64 AccessStatus; 
  UINT64 GrantedAccess; 
  LODWORD(AccessStatus) = 0;
  LODWORD(GrantedAccess) = 0;
  memset(&SubjectSecurityContext, 0, sizeof(SubjectSecurityContext));
  result = 0;
  if( PreviousMode )
  {
    SeCaptureSubjectContext(&SubjectSecurityContext);
    LODWORD(v3) = 0;
    v1 = SeAccessCheck(
           SeMediumDaclSd,
           &SubjectSecurityContext,
           0,
           0x20000ui64,
           v3,
           0i64,
           (GENERIC_MAPPING *)&ExpRestrictedGenericMapping,
           1,
           &GrantedAccess,
           &AccessStatus);
    SeReleaseSubjectContext(&SubjectSecurityContext);
    if( !v1 || (int)AccessStatus < 0 )
      return 1;
  }
  return result;
}

Referenced by: