SepNewTokenAsRestrictedAsProcessToken

NTSTATUS __stdcall SepNewTokenAsRestrictedAsProcessToken(
        VOID *NewToken,
        VOID *ProcessToken,
        _BYTE *NewTokenAsRestrictedAsProcessToken){
  int v4; 
  unsigned int v6; 
  unsigned int v7; 
  __int64 v8; 
  unsigned int v10; 
  unsigned int v11; 
  void *v12; 
  __int64 v13; 
  unsigned int v14; 
  unsigned int v15; 
  unsigned int v16; 
  unsigned int v17; 
  __int64 v18; 
  void *v19; 
  void *v20; 

  *NewTokenAsRestrictedAsProcessToken = 0;
  v4 = *((_DWORD *)ProcessToken + 50);
  if( ((v4 & 0x800) == 0 || (*((_DWORD *)NewToken + 50) & 0x800) != 0)
    && (!SeTokenIsRestricted(ProcessToken) || SeTokenIsRestricted(NewToken))
    && (!SeTokenIsWriteRestricted(ProcessToken) || SeTokenIsWriteRestricted(NewToken))
    && (!SeTokenIsRestricted(ProcessToken) || *((_DWORD *)ProcessToken + 32) >= *((_DWORD *)NewToken + 32))
    && (~*((_QWORD *)ProcessToken + 9) & *((_QWORD *)NewToken + 9)) == 0i64
    && (~*((_QWORD *)ProcessToken + 8) & *((_QWORD *)NewToken + 8)) == 0i64
    && (~v4 & *((_DWORD *)NewToken + 50) & 0x1000) == 0 )
  {
    if( SeTokenIsRestricted(ProcessToken) && (v14 = *((_DWORD *)NewToken + 32), v15 = 0, v14) )
    {
      v16 = *((_DWORD *)ProcessToken + 32);
      while( 1 )
      {
        v17 = 0;
        if( v16 )
        {
          v18 = *((_QWORD *)ProcessToken + 20);
          v19 = *(void **)(*((_QWORD *)NewToken + 20) + 16i64 * v15);
          do
          {
            if( RtlEqualSid(v19, *(PVOID *)(v18 + 16i64 * v17)) )
              break;
            ++v17;
          }
          while( v17 < v16 );
        }
        if( v17 == v16 )
          break;
        if( ++v15 >= v14 )
          goto LABEL_10;
      }
    }
    else
    {
LABEL_10:
      v6 = *((_DWORD *)ProcessToken + 31);
      v7 = 0;
      if( !v6 )
      {
LABEL_14:
        *NewTokenAsRestrictedAsProcessToken = 1;
        return 0;
      }
      v8 = *((_QWORD *)ProcessToken + 19);
      while( 1 )
      {
        if( (*(_DWORD *)(v8 + 16i64 * v7 + 8) & 0x10) != 0 )
        {
          v10 = *((_DWORD *)NewToken + 31);
          v11 = 0;
          if( v10 )
          {
            v12 = *(void **)(v8 + 16i64 * v7);
            v13 = *((_QWORD *)NewToken + 19);
            v20 = v12;
            while( !RtlEqualSid(v12, *(PVOID *)(v13 + 16i64 * v11)) )
            {
              v12 = v20;
              if( ++v11 >= v10 )
                goto LABEL_13;
            }
            if( (*(_DWORD *)(v13 + 16i64 * v11 + 8) & 0x10) == 0 )
              break;
          }
        }
LABEL_13:
        if( ++v7 >= v6 )
          goto LABEL_14;
      }
    }
  }
  return -1073741727;
}

Referenced by: