NtCompareTokens

INT64 __fastcall NtCompareTokens(VOID *FirstTokenHandle, VOID *SecondTokenHandle, UINT8 *Equal){
  UINT8 *v3; 
  char v6; 
  KPROCESSOR_MODE v7; 
  __int64 v8; 
  int InformationToken; 
  _TOKEN *v10; 
  unsigned int *v11; 
  __int64 v12; 
  _SID_AND_ATTRIBUTES *UserAndGroups; 
  void *TrustLevelSid; 
  void *v15; 
  UINT8 IsRestricted; 
  UINT8 v18; 
  PVOID TokenInformation; 
  PVOID Token; 
  unsigned int *v21; 
  PVOID AccessToken; 
  char v24; 
  v3 = Equal;
  v21 = 0i64;
  v6 = 0;
  v24 = 0;
  TokenInformation = 0i64;
  v7 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v7 )
  {
    v8 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)Equal < 0x7FFFFFFF0000i64 )
      v8 = (__int64)Equal;
    *(_BYTE *)v8 = *(_BYTE *)v8;
  }
  Token = 0i64;
  InformationToken = ObReferenceObjectByHandle(FirstTokenHandle, 8u, (POBJECT_TYPE)SeTokenObjectType, v7, &Token, 0i64);
  v10 = (_TOKEN *)Token;
  if( InformationToken < 0 )
  {
    v10 = 0i64;
LABEL_36:
    v11 = v21;
    goto LABEL_27;
  }
  if( FirstTokenHandle == SecondTokenHandle )
  {
    v6 = 1;
    goto LABEL_36;
  }
  AccessToken = 0i64;
  InformationToken = ObReferenceObjectByHandle(
                       SecondTokenHandle,
                       8u,
                       (POBJECT_TYPE)SeTokenObjectType,
                       v7,
                       &AccessToken,
                       0i64);
  v11 = (unsigned int *)AccessToken;
  if( InformationToken < 0 )
  {
    v11 = 0i64;
  }
  else if( v10 == AccessToken )
  {
    v6 = 1;
  }
  else
  {
    SepAcquireOrderedReadLocks(v10, (_TOKEN *)AccessToken);
    v24 = 1;
    v12 = *((_QWORD *)v11 + 19);
    UserAndGroups = v10->UserAndGroups;
    if( RtlEqualSid(UserAndGroups->Sid, *(PVOID *)v12) )
    {
      if( ((*(_BYTE *)(v12 + 8) ^ LOBYTE(UserAndGroups->Attributes)) & 0x14) == 0 )
      {
        InformationToken = SeQueryInformationToken(v10, TokenIsAppContainer, &TokenInformation);
        if( InformationToken >= 0 )
        {
          InformationToken = SeQueryInformationToken(v11, TokenIsAppContainer, (PVOID *)((char *)&TokenInformation + 4));
          if( InformationToken >= 0
            && (_DWORD)TokenInformation == HIDWORD(TokenInformation)
            && (!(_DWORD)TokenInformation
             || RtlEqualSid(v10->Package, *((PVOID *)v11 + 98))
             && SepCompareSidAndAttributeArrays(
                  v10->Capabilities,
                  v10->CapabilityCount,
                  *((_SID_AND_ATTRIBUTES **)v11 + 99),
                  v11[200])) )
          {
            TrustLevelSid = v10->TrustLevelSid;
            v15 = (void *)*((_QWORD *)v11 + 138);
            if( (TrustLevelSid != 0i64) == (v15 != 0i64) && (!TrustLevelSid || RtlEqualSid(TrustLevelSid, v15)) )
            {
              IsRestricted = SeTokenIsRestricted(v10);
              if( IsRestricted == SeTokenIsRestricted(v11) )
              {
                if( !IsRestricted
                  || (v18 = SeTokenIsWriteRestricted(v10), v18 == SeTokenIsWriteRestricted(v11))
                  && SepCompareSidAndAttributeArrays(
                       v10->RestrictedSids,
                       v10->RestrictedSidCount,
                       *((_SID_AND_ATTRIBUTES **)v11 + 20),
                       v11[32]) )
                {
                  if( v10->Privileges.Enabled == *((_QWORD *)v11 + 9)
                    && v10->Privileges.Present == *((_QWORD *)v11 + 8)
                    && v10->MandatoryPolicy == v11[53]
                    && SepCompareSidAndAttributeArrays(
                         v10->UserAndGroups + 1,
                         v10->UserAndGroupCount - 1,
                         (_SID_AND_ATTRIBUTES *)(*((_QWORD *)v11 + 19) + 16i64),
                         v11[31] - 1)
                    && SepCompareClaimAttributes(
                         v10->pClaimAttributes,
                         *((_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION **)v11 + 137))
                    && AuthzBasepCompareLegacySecurityAttributesInformation(
                         v10->pSecurityAttributes,
                         *((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)v11 + 97)) )
                  {
                    v6 = 1;
                  }
                }
              }
            }
          }
        }
      }
    }
    v3 = Equal;
  }
LABEL_27:
  if( v24 )
    SepReleaseOrderedReadLocks((INT64)v10, (INT64)v11);
  if( v10 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v10);
  if( v11 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v11);
  *v3 = v6;
  return(unsigned int)InformationToken;
}

Referenced by: