SeTokenCanImpersonate

INT64 __stdcall SeTokenCanImpersonate(
        PVOID ProcessToken,
        PVOID Token,
        _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
        UINT8 *UseProcessTrust){
  INT64 result; 
  void *v7; 
  void *v8; 
  _BYTE *v9; 
  NTSTATUS IsElevated; 
  void *v11; 
  void *v12; 
  int v13; 
  UINT8 pbDominate; 
  UINT8 v15; 
  UINT8 TokenIsElevated; 
  INT64 v17; 
  v15 = 0;
  pbDominate = 0;
  TokenIsElevated = 0;
  LODWORD(v17) = 0;
  *UseProcessTrust = 0;
  if( ImpersonationLevel < SecurityImpersonation )
    return 0i64;
  if( *((_DWORD *)Token + 6) == 998 && !*((_DWORD *)Token + 7) )
  {
    if( (*((_DWORD *)ProcessToken + 50) & 0x4000) != 0 )
    {
      if( (*((_DWORD *)Token + 50) & 0x4000) == 0 )
        return 3221225569i64;
      v7 = (void *)*((_QWORD *)Token + 98);
      v8 = (void *)*((_QWORD *)ProcessToken + 98);
      if( !RtlEqualSid(v8, v7) && !RtlIsParentOfChildAppContainer(v8, v7) )
        return 3221225569i64;
    }
    return 0i64;
  }
  LODWORD(result) = RtlSidDominatesForTrust(*((PVOID *)ProcessToken + 138), *((PVOID *)Token + 138), &pbDominate);
  if( (int)result < 0 )
    return result;
  if( !pbDominate )
    *v9 = 1;
  if( (*((_DWORD *)ProcessToken + 16) & *((_DWORD *)ProcessToken + 18) & 0x20000000) != 0 )
    return 0i64;
  SepAcquireOrderedReadLocks((_TOKEN *)ProcessToken, (_TOKEN *)Token);
  SepCopyTokenIntegrity((INT64)ProcessToken);
  SepCopyTokenIntegrity((INT64)Token);
  IsElevated = RtlSidDominates(0i64, 0i64, &v15);
  if( IsElevated >= 0 )
  {
    if( !v15 )
      goto LABEL_42;
    if( SepIsImpersonationAllowedDueToCapability(ProcessToken, Token)
      || *((_DWORD *)ProcessToken + 6) == *((_DWORD *)Token + 56)
      && *((_DWORD *)ProcessToken + 7) == *((_DWORD *)Token + 57) )
    {
      IsElevated = 0;
      goto LABEL_43;
    }
    if( !RtlEqualSid(**((PVOID **)ProcessToken + 19), **((PVOID **)Token + 19)) )
    {
LABEL_42:
      IsElevated = -1073741727;
      goto LABEL_43;
    }
    if( (int)RtlQueryElevationFlags(&v17) < 0 || (v17 & 1) == 0 )
      goto LABEL_32;
    IsElevated = SeTokenIsElevated(Token, &TokenIsElevated);
    if( IsElevated >= 0 )
    {
      if( !TokenIsElevated )
        goto LABEL_29;
      IsElevated = SeTokenIsElevated(ProcessToken, &TokenIsElevated);
      if( IsElevated >= 0 )
      {
        if( !TokenIsElevated && (*(_DWORD *)(*((_QWORD *)ProcessToken + 27) + 32i64) & 4) != 0 )
          goto LABEL_42;
LABEL_29:
        if( (*(_DWORD *)(*((_QWORD *)ProcessToken + 27) + 32i64) & 4) != 0
          && (*(_DWORD *)(*((_QWORD *)Token + 27) + 32i64) & 4) == 0 )
        {
          SepLogUnmatchedSessionFlagImpersonationAttempt((INT64)ProcessToken, (INT64)Token);
          goto LABEL_42;
        }
LABEL_32:
        IsElevated = 0;
        if( (*((_DWORD *)ProcessToken + 50) & 0x4000) == 0
          || (*((_DWORD *)Token + 50) & 0x4000) != 0
          && ((v11 = (void *)*((_QWORD *)Token + 98), v12 = (void *)*((_QWORD *)ProcessToken + 98),
                                                      RtlEqualSid(v12, v11))
           || RtlIsParentOfChildAppContainer(v12, v11)) )
        {
          if( !SeTokenIsRestricted(ProcessToken)
            || SeTokenIsRestricted(Token)
            && (SeTokenIsWriteRestricted(ProcessToken) || !SeTokenIsWriteRestricted(Token)) )
          {
            v13 = *((_DWORD *)Token + 30);
            if( *((_DWORD *)ProcessToken + 30) == v13 || v13 )
              goto LABEL_43;
          }
        }
        goto LABEL_42;
      }
    }
  }
LABEL_43:
  SepReleaseOrderedReadLocks((INT64)ProcessToken, (INT64)Token);
  return(unsigned int)IsElevated;
}

Referenced by: