PiAuCheckTokenMembership

NTSTATUS __stdcall PiAuCheckTokenMembership(VOID *SidToCheck, UINT8 *IsMember){
  size_t v4; 
  VOID **PoolWithTag; 
  _ACL *v6; 
  int Acl; 
  UINT64 v8; 
  _KPROCESSOR_MODE AccessMode; 
  int AccessStatus; 
  unsigned int GrantedAccess; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _GENERIC_MAPPING GenericMapping; 

  GrantedAccess = 0;
  AccessStatus = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  GenericMapping.GenericWrite = 0x20000;
  GenericMapping.GenericExecute = 0x20000;
  GenericMapping.GenericRead = 131073;
  GenericMapping.GenericAll = 2031617;
  *IsMember = 0;
  v4 = 3 * (RtlLengthSid((INT64)SidToCheck) + 20);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v4, 538996816i64);
  v6 = (_ACL *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memset(PoolWithTag, 0i64, v4);
  RtlCreateSecurityDescriptor(v6, 1ui64);
  RtlSetOwnerSecurityDescriptor(v6, SidToCheck, 0);
  RtlSetGroupSecurityDescriptor(v6, SidToCheck, 0);
  Acl = RtlCreateAcl(v6 + 5, (_ACL)(v4 - 40), 2ui64, v8);
  if( Acl >= 0 )
  {
    Acl = RtlpAddKnownAce(v6 + 5, 2ui64, 0i64, 1ui64, SidToCheck, 0);
    if( Acl >= 0 )
    {
      Acl = RtlSetDaclSecurityDescriptor(v6, 1u, v6 + 5, 0);
      if( Acl >= 0 )
      {
        SeCaptureSubjectContext((INT64)&SubjectContext);
        LOBYTE(AccessMode) = KeGetCurrentThread()->PreviousMode;
        *IsMember = (unsigned __int8)SeAccessCheck(
                                       v6,
                                       &SubjectContext,
                                       0,
                                       1,
                                       0,
                                       0i64,
                                       &GenericMapping,
                                       AccessMode,
                                       &GrantedAccess,
                                       &AccessStatus);
        SeReleaseSubjectContext(&SubjectContext);
        Acl = 0;
      }
    }
  }
  ExFreePoolWithTag(v6, 0);
  return Acl;
}

Referenced by: