SeTokenSetNoChildProcessRestricted

VOID __stdcall SeTokenSetNoChildProcessRestricted(PACCESS_TOKEN Token, BOOL UnlessSecure, BOOL AuditOnly){
  _ETHREAD *CurrentThread; 
  int v7; 
  int v8; 
  int v9; 
  unsigned int v10; 
  unsigned int v11; 
  signed __int32 v12[10]; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, AuditOnly);
  _InterlockedOr(v12, 0);
  v7 = *((_DWORD *)Token + 50);
  if( AuditOnly )
  {
    if( (v7 & 0x80000) != 0 )
      goto LABEL_6;
    v11 = v7 | 0x200000;
  }
  else
  {
    v8 = v7 | 0x80000;
    v9 = v7 | 0x180000;
    v10 = v8 & 0xFFEFFFFF;
    if( !UnlessSecure )
      v9 = v10;
    v11 = v9 & 0xFFDFFFFF;
  }
  *((_DWORD *)Token + 50) = v11;
LABEL_6:
  *((_QWORD *)Token + 7) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
  _InterlockedOr(v12, 0);
  ExReleaseResourceLite(*((PERESOURCE *)Token + 6));
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
}

Referenced by: