ObpCheckTraverseAccess

UINT8 __stdcall ObpCheckTraverseAccess(
        PVOID DirectoryObject,
        ACCESS_STATE *AccessState,
        INT8 PreviousMode,
        INT64 *AccessStatus){
  CHAR AccessMode; 
  __int64 v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  int ObjectSecurity; 
  UINT8 v10; 
  UINT64 v11; 
  PPRIVILEGE_SET Privileges; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  UINT64 GrantedAccess; 
  BOOLEAN MemoryAllocated; 
  KPROCESSOR_MODE v16; 
  PNTSTATUS v17; 
  MemoryAllocated = (unsigned __int8)AccessStatus;
  AccessMode = v16;
  LODWORD(GrantedAccess) = 0;
  Privileges = 0i64;
  SecurityDescriptor = 0i64;
  v5 = PreviousMode;
  v6 = (unsigned __int8)*((char *)DirectoryObject - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DirectoryObject - 48) >> 8);
  MemoryAllocated = 0;
  v7 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v6];
  ObjectSecurity = ObpGetObjectSecurity(DirectoryObject, &SecurityDescriptor, &MemoryAllocated, v16);
  if( ObjectSecurity >= 0 )
  {
    if( SeFastTraverseCheck(SecurityDescriptor, (ACCESS_STATE *)v5, 2ui64) )
    {
      v10 = 1;
    }
    else
    {
      SeLockSubjectContext((_SECURITY_SUBJECT_CONTEXT *)(v5 + 32));
      LODWORD(v11) = 0;
      v10 = SeAccessCheck(
              SecurityDescriptor,
              (SECURITY_SUBJECT_CONTEXT *)(v5 + 32),
              1u,
              2ui64,
              v11,
              &Privileges,
              (GENERIC_MAPPING *)(v7 + 76),
              AccessMode,
              &GrantedAccess,
              (INT64 *)v17);
      if( Privileges )
      {
        SeAppendPrivileges((PACCESS_STATE)v5, Privileges);
        CmSiFreeMemory(Privileges);
      }
      SeUnlockSubjectContext((SECURITY_SUBJECT_CONTEXT *)(v5 + 32));
    }
    ObReleaseObjectSecurity(SecurityDescriptor, MemoryAllocated);
    return v10;
  }
  else
  {
    *v17 = ObjectSecurity;
    return 0;
  }
}

Referenced by: