ObCheckObjectAccess

UINT8 __stdcall ObCheckObjectAccess(
        VOID *Object,
        _ACCESS_STATE *AccessState,
        UINT8 TypeMutexLocked,
        CHAR AccessMode,
        INT64 *AccessStatus){
  UINT8 v5; 
  unsigned __int64 v7; 
  _UNICODE_STRING *v10; 
  NTSTATUS ObjectSecurity; 
  UINT8 v12; 
  unsigned int v13; 
  UINT8 result; 
  _KPROCESSOR_MODE AccessModea; 
  unsigned int GrantedAccess; 
  PVOID SecurityDescriptor; 
  PPRIVILEGE_SET Privileges; 
  _UNICODE_STRING *v19; 
  UINT8 MemoryAllocated; 

  v5 = 0;
  v7 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  GrantedAccess = 0;
  MemoryAllocated = 0;
  Privileges = 0i64;
  SecurityDescriptor = 0i64;
  v10 = (_UNICODE_STRING *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v7];
  v19 = v10;
  ObjectSecurity = ObpGetObjectSecurity(Object, &SecurityDescriptor, &MemoryAllocated, AccessMode);
  if( ObjectSecurity < 0 )
    goto LABEL_9;
  if( !SecurityDescriptor )
  {
    *((_DWORD *)AccessState + 5) |= *((_DWORD *)AccessState + 4);
    *((_DWORD *)AccessState + 4) = 0;
    v5 = 1;
LABEL_9:
    result = v5;
    *(_DWORD *)AccessStatus = ObjectSecurity;
    return result;
  }
  SeLockSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
  LOBYTE(AccessModea) = AccessMode;
  v12 = (unsigned __int8)SeAccessCheck(
                           SecurityDescriptor,
                           (PSECURITY_SUBJECT_CONTEXT)AccessState + 1,
                           1u,
                           *((_DWORD *)AccessState + 4),
                           *((_DWORD *)AccessState + 5),
                           &Privileges,
                           (PGENERIC_MAPPING)((char *)&v10[4].Buffer + 4),
                           AccessModea,
                           &GrantedAccess,
                           (PNTSTATUS)AccessStatus);
  if( Privileges )
  {
    SeAppendPrivileges(AccessState, Privileges);
    CmSiFreeMemory(Privileges);
  }
  if( v12 )
  {
    v13 = GrantedAccess;
    *((_DWORD *)AccessState + 5) |= GrantedAccess;
    *((_DWORD *)AccessState + 4) &= ~(v13 | 0x2000000);
  }
  SeOpenObjectAuditAlarm(
    v19 + 1,
    Object,
    0i64,
    SecurityDescriptor,
    AccessState,
    0,
    v12,
    AccessMode,
    (UINT8 *)AccessState + 10);
  SeUnlockSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
  ObReleaseObjectSecurity(SecurityDescriptor, MemoryAllocated);
  return v12;
}

Referenced by: