SeTokenCanImpersonate

NTSTATUS __stdcall SeTokenCanImpersonate(
        VOID *ProcessToken,
        VOID *Token,
        _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
        UINT8 *UseProcessTrust){
  NTSTATUS result; 
  void *v7; 
  void *v8; 
  _BYTE *v9; 
  int IsElevated; 
  VOID *v11; 
  void *v12; 
  void *v13; 
  int v14; 
  _SID_AND_ATTRIBUTES v15; 
  _SID_AND_ATTRIBUTES IntegritySA; 
  UINT8 pbDominate; 
  UINT8 v18; 
  UINT8 TokenIsElevated; 
  int v20; 

  v18 = 0;
  pbDominate = 0;
  TokenIsElevated = 0;
  v20 = 0;
  *UseProcessTrust = 0;
  IntegritySA = 0i64;
  v15 = 0i64;
  if( ImpersonationLevel < SecurityImpersonation )
    return 0;
  if( *((_DWORD *)Token + 6) == 998 && !*((_DWORD *)Token + 7) )
  {
    if( (*((_DWORD *)ProcessToken + 50) & 0x4000) != 0 )
    {
      if( (*((_DWORD *)Token + 50) & 0x4000) == 0 )
        return -1073741727;
      v7 = (void *)*((_QWORD *)Token + 98);
      v8 = (void *)*((_QWORD *)ProcessToken + 98);
      if( !RtlEqualSid(v8, v7) && !RtlIsParentOfChildAppContainer(v8, v7) )
        return -1073741727;
    }
    return 0;
  }
  result = RtlSidDominatesForTrust(*((VOID **)ProcessToken + 138), *((VOID **)Token + 138), &pbDominate);
  if( result < 0 )
    return result;
  if( !pbDominate )
    *v9 = 1;
  if( (*((_DWORD *)ProcessToken + 16) & *((_DWORD *)ProcessToken + 18) & 0x20000000) != 0 )
    return 0;
  SepAcquireOrderedReadLocks((_TOKEN *)ProcessToken, (_TOKEN *)Token);
  SepCopyTokenIntegrity((_TOKEN *)ProcessToken, &IntegritySA);
  SepCopyTokenIntegrity((_TOKEN *)Token, &v15);
  IsElevated = RtlSidDominates(IntegritySA.Sid, v15.Sid, &v18);
  if( IsElevated >= 0 )
  {
    if( !v18 )
      goto LABEL_42;
    if( SepIsImpersonationAllowedDueToCapability(ProcessToken, Token, v11)
      || *((_DWORD *)ProcessToken + 6) == *((_DWORD *)Token + 56)
      && *((_DWORD *)ProcessToken + 7) == *((_DWORD *)Token + 57) )
    {
      IsElevated = 0;
      goto LABEL_43;
    }
    if( !RtlEqualSid(**((PVOID **)ProcessToken + 19), **((PVOID **)Token + 19)) )
    {
LABEL_42:
      IsElevated = -1073741727;
      goto LABEL_43;
    }
    if( (int)RtlQueryElevationFlags(&v20) < 0 || (v20 & 1) == 0 )
      goto LABEL_32;
    IsElevated = SeTokenIsElevated(Token, &TokenIsElevated);
    if( IsElevated >= 0 )
    {
      if( !TokenIsElevated )
        goto LABEL_29;
      IsElevated = SeTokenIsElevated(ProcessToken, &TokenIsElevated);
      if( IsElevated >= 0 )
      {
        if( !TokenIsElevated && (*(_DWORD *)(*((_QWORD *)ProcessToken + 27) + 32i64) & 4) != 0 )
          goto LABEL_42;
LABEL_29:
        if( (*(_DWORD *)(*((_QWORD *)ProcessToken + 27) + 32i64) & 4) != 0
          && (*(_DWORD *)(*((_QWORD *)Token + 27) + 32i64) & 4) == 0 )
        {
          SepLogUnmatchedSessionFlagImpersonationAttempt((INT64)ProcessToken, (INT64)Token);
          goto LABEL_42;
        }
LABEL_32:
        IsElevated = 0;
        if( (*((_DWORD *)ProcessToken + 50) & 0x4000) == 0
          || (*((_DWORD *)Token + 50) & 0x4000) != 0
          && ((v12 = (void *)*((_QWORD *)Token + 98), v13 = (void *)*((_QWORD *)ProcessToken + 98),
                                                      RtlEqualSid(v13, v12))
           || RtlIsParentOfChildAppContainer(v13, v12)) )
        {
          if( !SeTokenIsRestricted(ProcessToken)
            || SeTokenIsRestricted(Token)
            && (SeTokenIsWriteRestricted(ProcessToken) || !SeTokenIsWriteRestricted(Token)) )
          {
            v14 = *((_DWORD *)Token + 30);
            if( *((_DWORD *)ProcessToken + 30) == v14 || v14 )
              goto LABEL_43;
          }
        }
        goto LABEL_42;
      }
    }
  }
LABEL_43:
  SepReleaseOrderedReadLocks((_TOKEN *)ProcessToken, (_TOKEN *)Token);
  return IsElevated;
}

Referenced by: