SeTokenGetNoChildProcessRestricted

VOID __stdcall SeTokenGetNoChildProcessRestricted(
        PACCESS_TOKEN Token,
        PBOOLEAN Enforced,
        PBOOLEAN UnlessSecure,
        PBOOLEAN AuditOnly){
  _ETHREAD *CurrentThread; 
  int v9; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceSharedLite(*((_QWORD *)Token + 6), 1);
  v9 = *((_DWORD *)Token + 50);
  ExReleaseResourceLite(*((PERESOURCE *)Token + 6));
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  *Enforced = (v9 & 0x80000) != 0;
  *UnlessSecure = (v9 & 0x100000) != 0;
  *AuditOnly = (v9 & 0x200000) != 0;
}

Referenced by:

PspGetNoChildProcessRestrictedPolicy
SeSubProcessToken