SeExamineGlobalSacl

VOID __stdcall SeExamineGlobalSacl(
        _UNICODE_STRING *ObjectType,
        _ACL *ResourceSacl,
        PVOID Token,
        UINT64 DesiredAccess,
        UINT8 AccessGranted,
        UINT8 *GenerateAudit,
        UINT8 *GenerateAlarm){
  UINT8 *v7; 
  UINT8 v8; 
  ACCESS_MASK v9; 
  struct _ACL *v11; 
  _ETHREAD *CurrentThread; 
  struct _ACL *v14; 
  char v15; 
  char v16[8]; 
  __int64 v17; 
  v7 = GenerateAudit;
  v8 = 0;
  v9 = DesiredAccess;
  v11 = ResourceSacl;
  if( GenerateAudit && !*GenerateAudit )
  {
    v17 = 0i64;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    LOBYTE(ResourceSacl) = 1;
    ExAcquireResourceSharedLite(&SepRmGlobalSaclLock, (BOOL)ResourceSacl);
    if( (int)SepRmGlobalSaclFind(&v17, 0i64, ObjectType, 0) >= 0 )
    {
      v14 = *(struct _ACL **)(v17 + 24);
      if( v14 )
      {
        LOBYTE(GenerateAudit) = 0;
        v16[0] = 0;
        SeExamineSacl(v14, v11, Token, v9, AccessGranted, (PBOOLEAN)&GenerateAudit, (PBOOLEAN)v16);
        if( *v7 || (v15 = 0, (_BYTE)GenerateAudit) )
          v15 = 1;
        *v7 = v15;
        if( GenerateAlarm )
        {
          if( *GenerateAlarm || v16[0] )
            v8 = 1;
          *GenerateAlarm = v8;
        }
      }
    }
    ExReleaseResourceLite(&SepRmGlobalSaclLock);
    KeLeaveCriticalRegion();
  }
}

Referenced by: