EtwpCheckCurrentUserProcessAccess

INT64 __fastcall EtwpCheckCurrentUserProcessAccess(VOID *a1){
  unsigned int v1; 
  BOOLEAN MemoryAllocated; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  SecurityDescriptor = 0i64;
  MemoryAllocated = 0;
  ObpGetObjectSecurity(a1, &SecurityDescriptor, &MemoryAllocated, 0);
  v1 = EtwpAccessCheck(SecurityDescriptor, 0x1FFFFFui64, 0i64);
  ObReleaseObjectSecurity(SecurityDescriptor, MemoryAllocated);
  return v1;
}

Referenced by: