SeIsTokenAssignableToProcess

NTSTATUS __stdcall SeIsTokenAssignableToProcess(VOID *pAccessToken, UINT8 *pbIsAssignable, UINT64 a3){
  UINT8 v3; 
  _EPROCESS *Process; 
  VOID *v7; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v9; 
  int v10; 
  int v11; 
  NTSTATUS result; 
  UINT64 v13; 
  UINT8 v14; 
  _SID_AND_ATTRIBUTES v15; 
  _SID_AND_ATTRIBUTES IntegritySA; 
  UINT8 IsChild; 
  UINT8 pbDominate; 
  UINT8 IsSibling; 

  v3 = 0;
  *pbIsAssignable = 0;
  IsChild = 0;
  v15 = 0i64;
  IsSibling = 0;
  Process = KeGetCurrentThread()->ApcState.Process;
  IntegritySA = 0i64;
  pbDominate = 0;
  v7 = PsReferencePrimaryToken(Process);
  if( !v7 )
    return -1073741823;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceSharedLite(*((_QWORD *)v7 + 6), 1);
  SepCopyTokenIntegrity((_TOKEN *)v7, &IntegritySA);
  ExReleaseResourceLite(*((PERESOURCE *)v7 + 6));
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  ObFastDereferenceObject(&KeGetCurrentThread()->ApcState.Process->Token, v7);
  v9 = (_ETHREAD *)KeGetCurrentThread();
  --v9->Tcb.KernelApcDisable;
  ExAcquireResourceSharedLite(*((_QWORD *)pAccessToken + 6), 1);
  SepCopyTokenIntegrity((_TOKEN *)pAccessToken, &v15);
  v10 = *((_DWORD *)pAccessToken + 48);
  v11 = *((_DWORD *)pAccessToken + 49);
  ExReleaseResourceLite(*((PERESOURCE *)pAccessToken + 6));
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( v10 == 2 && v11 < 2 )
    return -1073741659;
  result = RtlSidDominates(IntegritySA.Sid, v15.Sid, &pbDominate);
  if( result >= 0 )
  {
    if( pbDominate )
    {
      result = SepIsChildTokenByPointer(pAccessToken, &IsChild);
      v14 = IsChild;
      if( !IsChild )
      {
        if( result < 0 )
          return result;
        result = SepIsSiblingTokenByPointer(pAccessToken, &IsSibling, v13);
      }
    }
    else
    {
      v14 = IsChild;
    }
    if( result >= 0 )
    {
      if( v14 || IsSibling )
        v3 = 1;
      *pbIsAssignable = v3;
    }
  }
  return result;
}

Referenced by: