SepIsSiblingTokenByPointer

NTSTATUS __stdcall SepIsSiblingTokenByPointer(PVOID Token, UINT8 *IsSibling){
  _ETHREAD *CurrentThread; 
  __int64 v5; 
  _TOKEN *v6; 
  _TOKEN *v7; 
  _LUID ParentTokenId; 
  _LUID AuthenticationId; 
  __int64 v10; 
  __int64 v11; 
  _SEP_LOGON_SESSION_REFERENCES *LogonSession; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *IsSibling = 0;
  v5 = *((_QWORD *)CurrentThread + 23);
  v6 = (_TOKEN *)PsReferencePrimaryToken((PEPROCESS)v5);
  v7 = v6;
  if( !v6 )
    return -1073741823;
  ParentTokenId = v6->ParentTokenId;
  AuthenticationId = v6->AuthenticationId;
  ObFastDereferenceObject((INT64 *)(v5 + 1208), (struct DMA_ADAPTER *)v6);
  v10 = *((_QWORD *)Token + 3);
  if( *((_QWORD *)Token + 4) == ParentTokenId )
  {
    if( v10 == AuthenticationId )
    {
      *IsSibling = 1;
    }
    else
    {
      SepAcquireOrderedReadLocks(v7, (_TOKEN *)Token);
      if( (v7->TokenFlags & 0x20) == 0 && (*((_DWORD *)Token + 50) & 0x20) == 0 )
      {
        v11 = *((_QWORD *)Token + 27);
        LogonSession = v7->LogonSession;
        if( (LogonSession->Flags & *(_BYTE *)(v11 + 32) & 0x40) != 0
          && AuthenticationId == *(_QWORD *)(v11 + 168)
          && v10 == *(_QWORD *)&LogonSession->SiblingAuthId )
        {
          *IsSibling = 1;
        }
      }
      SepReleaseOrderedReadLocks((INT64)v7, (INT64)Token);
    }
  }
  return 0;
}

Referenced by: