SeShouldCheckForAccessRightsFromParent

UINT8 __fastcall SeShouldCheckForAccessRightsFromParent(
        VOID *ObjectType,
        VOID *ChildDescriptor,
        _ACCESS_STATE *AccessState){
  UINT8 v5; 
  char v6; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *TrustLabelAce; 
  __int64 v8; 
  ULONG *p_SidStart; 
  PVOID v11; 
  UINT8 pbDominate; 
  __int64 v13; 
  v5 = 1;
  v13 = 0i64;
  v6 = 0;
  TrustLabelAce = SeGetTrustLabelAce(ChildDescriptor);
  if( TrustLabelAce )
  {
    p_SidStart = &TrustLabelAce->SidStart;
    if( TrustLabelAce != (_SYSTEM_PROCESS_TRUST_LABEL_ACE *)-8i64 )
    {
      pbDominate = 0;
      LODWORD(v11) = SepLocateTokenTrustLevel((SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
      RtlSidDominatesForTrust(v11, p_SidStart, &pbDominate);
      v5 = pbDominate;
    }
  }
  v8 = *((_QWORD *)AccessState + 4);
  if( !v8 )
    v8 = *((_QWORD *)AccessState + 6);
  SepFilterCheck((__int64)ChildDescriptor, 0i64, v8, 1, (char *)&v13);
  if( (*((_DWORD *)AccessState + 4) & (unsigned int)v13) == *((_DWORD *)AccessState + 4) )
    v6 = 1;
  return v5 && v6;
}

Referenced by: