CmpIsSystemEntity

UINT8 __stdcall CmpIsSystemEntity(UINT64 *VirtContext){
  struct _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  int *v2; 
  char v3; 
  int *v4; 
  void *ClientToken; 
  void *PrimaryToken; 
  UINT8 v7; 
  int v8; 
  int v9; 
  _EPROCESS *CurrentThreadProcess; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  PVOID TokenInformation; 
  v3 = 0;
  v4 = v2;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( !CmpVEEnabled )
    return 1;
  if( v2 && (*v2 & 1) != 0 )
    return(*v2 & 2) != 0;
  if( !(_BYTE)VirtContext )
    return 1;
  if( !p_SubjectContext )
  {
    CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
    SeCaptureSubjectContextEx((_ETHREAD *)KeGetCurrentThread(), CurrentThreadProcess, &SubjectContext);
    p_SubjectContext = &SubjectContext;
    v3 = 1;
  }
  ClientToken = p_SubjectContext->ClientToken;
  LODWORD(TokenInformation) = 0;
  if( ClientToken )
    PrimaryToken = ClientToken;
  else
    PrimaryToken = p_SubjectContext->PrimaryToken;
  v7 = 1;
  if( !ClientToken )
  {
    SeQueryInformationToken(PrimaryToken, TokenVirtualizationEnabled, &TokenInformation);
    if( (_DWORD)TokenInformation )
      v7 = 0;
  }
  if( v4 )
  {
    v8 = *v4;
    if( v7 )
    {
      v9 = v8 | 3;
    }
    else
    {
      v9 = v8 | 5;
      v7 = 0;
    }
    *v4 = v9;
  }
  if( v3 )
    SeReleaseSubjectContext(&SubjectContext);
  return v7;
}

Referenced by: