PiAuCheckTokenMembership

VOID __stdcall PiAuCheckTokenMembership(PVOID SidToCheck, UINT8 *IsMember){
  unsigned int v4; 
  ACL *PoolWithTag; 
  ACL *v6; 
  UINT64 PreviouslyGrantedAccess; 
  INT64 GrantedAccess; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  GENERIC_MAPPING GenericMapping; 
  GrantedAccess = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  GenericMapping.GenericWrite = 0x20000;
  GenericMapping.GenericExecute = 0x20000;
  GenericMapping.GenericRead = 131073;
  GenericMapping.GenericAll = 2031617;
  *IsMember = 0;
  v4 = 3 * (RtlLengthSid(SidToCheck) + 20);
  PoolWithTag = (ACL *)ExAllocatePoolWithTag(PagedPool, v4, 0x20207050ui64);
  v6 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    RtlCreateSecurityDescriptor(v6, 1ui64);
    RtlSetOwnerSecurityDescriptor(v6, SidToCheck, 0);
    RtlSetGroupSecurityDescriptor(v6, SidToCheck, 0);
    if( RtlCreateAcl(v6 + 5, v4 - 40, 2u) >= 0
      && (int)RtlpAddKnownAce(v6 + 5, 2ui64, 0i64, 1ui64, SidToCheck, 0) >= 0
      && RtlSetDaclSecurityDescriptor(v6, 1u, v6 + 5, 0) >= 0 )
    {
      SeCaptureSubjectContext(&SubjectContext);
      LODWORD(PreviouslyGrantedAccess) = 0;
      *IsMember = SeAccessCheck(
                    v6,
                    &SubjectContext,
                    0,
                    1ui64,
                    PreviouslyGrantedAccess,
                    0i64,
                    &GenericMapping,
                    *((_BYTE *)KeGetCurrentThread() + 562),
                    (UINT64 *)((char *)&GrantedAccess + 4),
                    &GrantedAccess);
      SeReleaseSubjectContext(&SubjectContext);
    }
    ExFreePoolWithTag(v6, 0);
  }
}

Referenced by: