ObCheckObjectAccess

UINT8 __stdcall ObCheckObjectAccess(
        PVOID Object,
        _ACCESS_STATE *AccessState,
        UINT8 TypeMutexLocked,
        CHAR AccessMode,
        INT64 *AccessStatus){
  UINT8 v5; 
  unsigned __int64 v7; 
  UNICODE_STRING *v10; 
  NTSTATUS ObjectSecurity; 
  UINT8 v12; 
  int v13; 
  UINT8 result; 
  UINT64 PreviouslyGrantedAccess; 
  UINT64 GrantedAccess; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  PPRIVILEGE_SET Privileges; 
  UNICODE_STRING *v19; 
  BOOLEAN MemoryAllocated; 
  v5 = 0;
  v7 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  LODWORD(GrantedAccess) = 0;
  MemoryAllocated = 0;
  Privileges = 0i64;
  SecurityDescriptor = 0i64;
  v10 = (UNICODE_STRING *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v7];
  v19 = v10;
  ObjectSecurity = ObpGetObjectSecurity(Object, &SecurityDescriptor, &MemoryAllocated, AccessMode);
  if( ObjectSecurity < 0 )
    goto LABEL_9;
  if( !SecurityDescriptor )
  {
    *((_DWORD *)AccessState + 5) |= *((_DWORD *)AccessState + 4);
    *((_DWORD *)AccessState + 4) = 0;
    v5 = 1;
LABEL_9:
    result = v5;
    *(_DWORD *)AccessStatus = ObjectSecurity;
    return result;
  }
  SeLockSubjectContext((_SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
  LODWORD(PreviouslyGrantedAccess) = *((_DWORD *)AccessState + 5);
  v12 = SeAccessCheck(
          SecurityDescriptor,
          (SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
          1u,
          *((unsigned int *)AccessState + 4),
          PreviouslyGrantedAccess,
          &Privileges,
          (GENERIC_MAPPING *)((char *)&v10[4].Buffer + 4),
          AccessMode,
          &GrantedAccess,
          AccessStatus);
  if( Privileges )
  {
    SeAppendPrivileges(AccessState, Privileges);
    CmSiFreeMemory(Privileges);
  }
  if( v12 )
  {
    v13 = GrantedAccess;
    *((_DWORD *)AccessState + 5) |= GrantedAccess;
    *((_DWORD *)AccessState + 4) &= ~(v13 | 0x2000000);
  }
  SeOpenObjectAuditAlarm(
    v19 + 1,
    Object,
    0i64,
    SecurityDescriptor,
    AccessState,
    0,
    v12,
    AccessMode,
    (UINT8 *)AccessState + 10);
  SeUnlockSubjectContext((SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
  ObReleaseObjectSecurity(SecurityDescriptor, MemoryAllocated);
  return v12;
}

Referenced by: