SepCheckForCriticalAceRemoval

CHAR __fastcall SepCheckForCriticalAceRemoval(
        PVOID SecurityDescriptor,
        PVOID a2,
        _SECURITY_SUBJECT_CONTEXT *a3,
        _BYTE *a4,
        INT64 a5){
  void **v5; 
  void *ClientToken; 
  void *retaddr; 
  v5 = &retaddr;
  if( a4 )
    *a4 = 0;
  if( a5 )
    *(_BYTE *)a5 = 0;
  if( !SepAllowAllApplicationAceRemoval )
  {
    LOBYTE(v5) = SeSinglePrivilegeCheckEx(*(_QWORD *)&SeTcbPrivilege, a3, *((_BYTE *)KeGetCurrentThread() + 562));
    if( !(_BYTE)v5 )
    {
      ClientToken = a3->ClientToken;
      if( !a3->ClientToken )
        ClientToken = a3->PrimaryToken;
      LOBYTE(v5) = SepSidInToken(ClientToken, 0i64, SeTrustedInstallerSid, 0, 0, 0);
      if( !(_BYTE)v5 )
        LOBYTE(v5) = SepHasCriticalAcesRemoved(SecurityDescriptor, a2, a4, (_BYTE *)a5);
    }
  }
  return(char)v5;
}

Referenced by: