RtlIsSandboxedToken

INT64 __stdcall RtlIsSandboxedToken(_SECURITY_SUBJECT_CONTEXT *Context, CHAR PreviousMode){
  char v3; 
  _SECURITY_SUBJECT_CONTEXT *v5; 
  struct _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  KTRANSACTION *v7; 
  INT64 result; 
  void *ClientToken; 
  UINT64 DesiredAccess; 
  UINT64 PreviouslyGrantedAccess; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  PVOID TokenInformation; 
  INT64 AccessStatus; 
  UINT64 GrantedAccess; 
  v3 = 0;
  LODWORD(TokenInformation) = 0;
  v5 = 0i64;
  LODWORD(GrantedAccess) = 0;
  LODWORD(AccessStatus) = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( PreviousMode )
  {
    if( !Context )
      SeCaptureSubjectContext(&SubjectContext);
    p_SubjectContext = &SubjectContext;
    if( Context )
      p_SubjectContext = Context;
    LODWORD(PreviouslyGrantedAccess) = 0;
    v5 = p_SubjectContext;
    LODWORD(DesiredAccess) = 0x20000;
    if( SeAccessCheckWithHint(
           SeMediumDaclSd,
           8ui64,
           p_SubjectContext,
           0i64,
           DesiredAccess,
           PreviouslyGrantedAccess,
           0i64,
           (GENERIC_MAPPING *)&RtlpRestrictedMapping,
           PreviousMode,
           &GrantedAccess,
           &AccessStatus) )
    {
      if( !ext_ms_win_ntos_tm_l1_1_0_TmIsKTMCommitCoordinator(v7) )
        goto LABEL_8;
      ClientToken = p_SubjectContext->ClientToken;
      if( !p_SubjectContext->ClientToken )
        ClientToken = p_SubjectContext->PrimaryToken;
      if( (int)SeQueryInformationToken(ClientToken, TokenIsAppContainer, &TokenInformation) >= 0
        && !(_DWORD)TokenInformation )
      {
LABEL_8:
        v3 = 1;
      }
    }
  }
  else
  {
    v3 = 1;
  }
  result = (INT64)&SubjectContext;
  if( v5 == &SubjectContext )
    SeReleaseSubjectContext(v5);
  LOBYTE(result) = v3 != 1;
  return result;
}

Referenced by: