CmpExamineSaclForAuditEvent

INT64 __stdcall CmpExamineSaclForAuditEvent(PVOID SecurityDescriptor, UINT8 *GenerateAudit){
  _BYTE *v2; 
  _BYTE *v3; 
  int SaclSecurityDescriptor; 
  WCHAR v6; 
  void *v7; 
  void *v8; 
  unsigned __int8 SaclPresent; 
  char SaclDefaulted[7]; 
  PACL Sacl; 
  struct _UNICODE_STRING DestinationString; 
  UINT8 v14; 
  UINT8 GenerateAlarm; 
  Sacl = 0i64;
  v3 = v2;
  *v2 = 0;
  v14 = 0;
  GenerateAlarm = 0;
  SaclPresent = 0;
  DestinationString = 0i64;
  SaclSecurityDescriptor = RtlGetSaclSecurityDescriptor(SecurityDescriptor, &SaclPresent, &Sacl, (UINT8 *)SaclDefaulted);
  if( SaclSecurityDescriptor >= 0 )
  {
    if( SaclPresent )
    {
      v7 = (void *)CmpEffectiveTokenForSubject((INT64 *)GenerateAudit, 0i64);
      SeExamineSacl(Sacl, Sacl, v7, 0xF003Fu, 1u, &v14, &GenerateAlarm);
    }
    RtlInitUnicodeString(&DestinationString, L"Key", v6);
    v8 = (void *)CmpEffectiveTokenForSubject((INT64 *)GenerateAudit, 0i64);
    SeExamineGlobalSacl(&DestinationString, Sacl, v8, 0xF003Fui64, 1u, &v14, &GenerateAlarm);
    if( v14 || GenerateAlarm )
      *v3 = 1;
  }
  return(unsigned int)SaclSecurityDescriptor;
}

Referenced by: