SepIsChildTokenByPointer

NTSTATUS __stdcall SepIsChildTokenByPointer(PVOID Token, UINT8 *IsChild){
  _ETHREAD *CurrentThread; 
  __int64 v5; 
  struct DMA_ADAPTER *v6; 
  __int64 v7; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *IsChild = 0;
  v5 = *((_QWORD *)CurrentThread + 23);
  v6 = (struct DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)v5);
  if( !v6 )
    return -1073741823;
  v7 = *(_QWORD *)&v6[1].Version;
  ObFastDereferenceObject((INT64 *)(v5 + 1208), v6);
  if( *((_QWORD *)Token + 4) == v7 )
    *IsChild = 1;
  return 0;
}

Referenced by: