SepCanTokenMatchAllPackageSid
UINT8 __stdcall SepCanTokenMatchAllPackageSid(_TOKEN *Token){
char v2;
bool v3;
_ETHREAD *CurrentThread;
int v5;
__int128 v7;
__int128 v8[5];
memset(v8, 0i64, 0x48u);
*(_QWORD *)&v7 = 2359330i64;
*((_QWORD *)&v7 + 1) = L"WIN:
v2 = 0;
v3 = 1;
*((_QWORD *)&v8[0] + 1) = Token->pSecurityAttributes;
v8[1] = v7;
if( KeGetCurrentIrql() < 2u )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)Token->TokenLock, 1);
v2 = 1;
}
AuthzBasepQuerySecurityAttributeAndValues();
if( v5 >= 0 )
v3 = **(_QWORD **)&v8[3] == 0i64;
if( v2 )
{
ExReleaseResourceLite(Token->TokenLock);
KeLeaveCriticalRegion();
}
return v3;
}Referenced by:
SeQueryInformationToken
SepMatchPackage