ObpCheckObjectReference

UINT8 __stdcall ObpCheckObjectReference(VOID *Object, _ACCESS_STATE *AccessState, CHAR AccessMode, INT64 *AccessStatus){
  CHAR v5; 
  unsigned __int64 v6; 
  __int64 v8; 
  int ObjectSecurity; 
  _GENERIC_MAPPING *GenericMapping; 
  VOID *v11; 
  _LUID *v12; 
  UINT8 v13; 
  unsigned int v14; 
  UINT64 PreviouslyGrantedAccess; 
  _PRIVILEGE_SET *Privileges; 
  _KPROCESSOR_MODE AccessModea; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  PPRIVILEGE_SET v20; 
  unsigned int GrantedAccess; 
  UINT8 MemoryAllocated; 
  PNTSTATUS v23; 

  MemoryAllocated = AccessMode;
  GrantedAccess = 0;
  v20 = 0i64;
  SecurityDescriptor = 0i64;
  v5 = (char)AccessStatus;
  v6 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  MemoryAllocated = 0;
  v8 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v6];
  ObjectSecurity = ObpGetObjectSecurity(Object, &SecurityDescriptor, &MemoryAllocated, (INT8)AccessStatus);
  if( ObjectSecurity < 0 )
  {
    *v23 = ObjectSecurity;
    return 0;
  }
  else
  {
    SeLockSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
    GenericMapping = (_GENERIC_MAPPING *)(v8 + 76);
    v11 = SecurityDescriptor;
    LOBYTE(AccessModea) = v5;
    v13 = (unsigned __int8)SeAccessCheck(
                             SecurityDescriptor,
                             (PSECURITY_SUBJECT_CONTEXT)AccessState + 1,
                             1u,
                             *((_DWORD *)AccessState + 4),
                             *((_DWORD *)AccessState + 5),
                             &v20,
                             GenericMapping,
                             AccessModea,
                             &GrantedAccess,
                             v23);
    if( v13 )
    {
      v14 = GrantedAccess;
      *((_DWORD *)AccessState + 5) |= GrantedAccess;
      v12 = (_LUID *)~v14;
      *((_DWORD *)AccessState + 4) &= (unsigned int)v12;
    }
    if( v11 )
    {
      LODWORD(PreviouslyGrantedAccess) = *((_DWORD *)AccessState + 4) | *((_DWORD *)AccessState + 5);
      SeObjectReferenceAuditAlarm(
        v12,
        Object,
        v11,
        (_SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
        PreviouslyGrantedAccess,
        Privileges,
        v13,
        v5);
    }
    SeUnlockSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
    ObReleaseObjectSecurity(v11, MemoryAllocated);
    return v13;
  }
}

Referenced by: