SeIsTokenAssignableToProcess

INT64 __fastcall SeIsTokenAssignableToProcess(VOID *pAccessToken, UINT8 *pbIsAssignable){
  UINT8 v2; 
  _EPROCESS *v5; 
  BOOL v6; 
  PERESOURCE *v7; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v9; 
  BOOL v10; 
  int v11; 
  int v12; 
  INT64 result; 
  UINT8 v14; 
  UINT8 IsChild; 
  UINT8 pbDominate; 
  UINT8 IsSibling; 
  v2 = 0;
  *pbIsAssignable = 0;
  IsChild = 0;
  IsSibling = 0;
  v5 = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
  pbDominate = 0;
  v7 = (PERESOURCE *)PsReferencePrimaryToken((PEPROCESS)v5);
  if( !v7 )
    return 3221225473i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  LOBYTE(v6) = 1;
  ExAcquireResourceSharedLite(v7[6], v6);
  SepCopyTokenIntegrity((INT64)v7);
  ExReleaseResourceLite(v7[6]);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  ObFastDereferenceObject((INT64 *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1208i64), (struct DMA_ADAPTER *)v7);
  v9 = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)v9 + 242);
  LOBYTE(v10) = 1;
  ExAcquireResourceSharedLite(*((PERESOURCE *)pAccessToken + 6), v10);
  SepCopyTokenIntegrity((INT64)pAccessToken);
  v11 = *((_DWORD *)pAccessToken + 48);
  v12 = *((_DWORD *)pAccessToken + 49);
  ExReleaseResourceLite(*((PERESOURCE *)pAccessToken + 6));
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( v11 == 2 && v12 < 2 )
    return 3221225637i64;
  LODWORD(result) = RtlSidDominates(0i64, 0i64, &pbDominate);
  if( (int)result >= 0 )
  {
    if( pbDominate )
    {
      LODWORD(result) = SepIsChildTokenByPointer(pAccessToken, &IsChild);
      v14 = IsChild;
      if( !IsChild )
      {
        if( (int)result < 0 )
          return result;
        LODWORD(result) = SepIsSiblingTokenByPointer(pAccessToken, &IsSibling);
      }
    }
    else
    {
      v14 = IsChild;
    }
    if( (int)result >= 0 )
    {
      if( v14 || IsSibling )
        v2 = 1;
      *pbIsAssignable = v2;
    }
  }
  return result;
}

Referenced by: