SepIsSiblingTokenByPointer

NTSTATUS __stdcall SepIsSiblingTokenByPointer(VOID *Token, UINT8 *IsSibling, UINT64 a3){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  _TOKEN *v7; 
  _TOKEN *v8; 
  _LUID ParentTokenId; 
  _LUID AuthenticationId; 
  __int64 v11; 
  __int64 v12; 
  _SEP_LOGON_SESSION_REFERENCES *LogonSession; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *IsSibling = 0;
  Process = CurrentThread->Tcb.ApcState.Process;
  v7 = (_TOKEN *)PsReferencePrimaryToken(Process);
  v8 = v7;
  if( !v7 )
    return -1073741823;
  ParentTokenId = v7->ParentTokenId;
  AuthenticationId = v7->AuthenticationId;
  ObFastDereferenceObject(&Process->Token, v7);
  v11 = *((_QWORD *)Token + 3);
  if( *((_QWORD *)Token + 4) == ParentTokenId )
  {
    if( v11 == AuthenticationId )
    {
      *IsSibling = 1;
    }
    else
    {
      SepAcquireOrderedReadLocks(v8, (_TOKEN *)Token);
      if( (v8->TokenFlags & 0x20) == 0 && (*((_DWORD *)Token + 50) & 0x20) == 0 )
      {
        v12 = *((_QWORD *)Token + 27);
        LogonSession = v8->LogonSession;
        if( (LogonSession->Flags & *(_BYTE *)(v12 + 32) & 0x40) != 0
          && AuthenticationId == *(_QWORD *)(v12 + 168)
          && v11 == *(_QWORD *)&LogonSession->SiblingAuthId )
        {
          *IsSibling = 1;
        }
      }
      SepReleaseOrderedReadLocks(v8, (_TOKEN *)Token);
    }
  }
  return 0;
}

Referenced by: