SepIsChildTokenByPointer

NTSTATUS __stdcall SepIsChildTokenByPointer(PVOID Token, UINT8 *IsChild){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  _QWORD *v6; 
  __int64 v7; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *IsChild = 0;
  Process = CurrentThread->Tcb.ApcState.Process;
  v6 = PsReferencePrimaryToken(Process);
  if( !v6 )
    return -1073741823;
  v7 = v6[2];
  ObFastDereferenceObject(&Process->Token, v6);
  if( *((_QWORD *)Token + 4) == v7 )
    *IsChild = 1;
  return 0;
}

Referenced by: