NtCompareTokens

NTSTATUS __stdcall NtCompareTokens(VOID *FirstTokenHandle, VOID *SecondTokenHandle, UINT8 *Equal){
  UINT8 *v3; 
  char v6; 
  char PreviousMode; 
  __int64 v8; 
  int InformationToken; 
  _TOKEN *v10; 
  unsigned int *v11; 
  __int64 v12; 
  _SID_AND_ATTRIBUTES *UserAndGroups; 
  void *TrustLevelSid; 
  void *v15; 
  UINT8 IsRestricted; 
  UINT8 v17; 
  UINT8 v19; 
  VOID *TokenInformation; 
  PVOID AccessToken; 
  unsigned int *v22; 
  PVOID Token; 
  char v25; 

  v3 = Equal;
  v22 = 0i64;
  v6 = 0;
  v25 = 0;
  TokenInformation = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v8 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)Equal < 0x7FFFFFFF0000i64 )
      v8 = (__int64)Equal;
    *(_BYTE *)v8 = *(_BYTE *)v8;
  }
  AccessToken = 0i64;
  InformationToken = ObReferenceObjectByHandle(
                       FirstTokenHandle,
                       8ui64,
                       (_OBJECT_TYPE *)SeTokenObjectType,
                       PreviousMode,
                       &AccessToken,
                       0i64);
  v10 = (_TOKEN *)AccessToken;
  if( InformationToken < 0 )
  {
    v10 = 0i64;
LABEL_36:
    v11 = v22;
    goto LABEL_27;
  }
  if( FirstTokenHandle == SecondTokenHandle )
  {
    v6 = 1;
    goto LABEL_36;
  }
  Token = 0i64;
  InformationToken = ObReferenceObjectByHandle(
                       SecondTokenHandle,
                       8ui64,
                       (_OBJECT_TYPE *)SeTokenObjectType,
                       PreviousMode,
                       &Token,
                       0i64);
  v11 = (unsigned int *)Token;
  if( InformationToken < 0 )
  {
    v11 = 0i64;
  }
  else if( v10 == Token )
  {
    v6 = 1;
  }
  else
  {
    SepAcquireOrderedReadLocks(v10, (_TOKEN *)Token);
    v25 = 1;
    v12 = *((_QWORD *)v11 + 19);
    UserAndGroups = v10->UserAndGroups;
    if( RtlEqualSid(UserAndGroups->Sid, *(PVOID *)v12) )
    {
      if( ((*(_BYTE *)(v12 + 8) ^ LOBYTE(UserAndGroups->Attributes)) & 0x14) == 0 )
      {
        InformationToken = SeQueryInformationToken(v10, TokenIsAppContainer, &TokenInformation);
        if( InformationToken >= 0 )
        {
          InformationToken = SeQueryInformationToken(v11, TokenIsAppContainer, (VOID **)((char *)&TokenInformation + 4));
          if( InformationToken >= 0
            && (_DWORD)TokenInformation == HIDWORD(TokenInformation)
            && (!(_DWORD)TokenInformation
             || RtlEqualSid(v10->Package, *((PVOID *)v11 + 98))
             && SepCompareSidAndAttributeArrays(
                  v10->Capabilities,
                  v10->CapabilityCount,
                  *((_SID_AND_ATTRIBUTES **)v11 + 99),
                  v11[200])) )
          {
            TrustLevelSid = v10->TrustLevelSid;
            v15 = (void *)*((_QWORD *)v11 + 138);
            if( (TrustLevelSid != 0i64) == (v15 != 0i64) && (!TrustLevelSid || RtlEqualSid(TrustLevelSid, v15)) )
            {
              IsRestricted = SeTokenIsRestricted(v10);
              if( IsRestricted == SeTokenIsRestricted(v11) )
              {
                if( !IsRestricted
                  || (v19 = SeTokenIsWriteRestricted(v10), v19 == SeTokenIsWriteRestricted(v11))
                  && SepCompareSidAndAttributeArrays(
                       v10->RestrictedSids,
                       v10->RestrictedSidCount,
                       *((_SID_AND_ATTRIBUTES **)v11 + 20),
                       v11[32]) )
                {
                  if( v10->Privileges.Enabled == *((_QWORD *)v11 + 9)
                    && v10->Privileges.Present == *((_QWORD *)v11 + 8)
                    && v10->MandatoryPolicy == v11[53]
                    && SepCompareSidAndAttributeArrays(
                         v10->UserAndGroups + 1,
                         v10->UserAndGroupCount - 1,
                         (_SID_AND_ATTRIBUTES *)(*((_QWORD *)v11 + 19) + 16i64),
                         v11[31] - 1)
                    && SepCompareClaimAttributes(
                         v10->pClaimAttributes,
                         *((_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION **)v11 + 137),
                         v17)
                    && AuthzBasepCompareLegacySecurityAttributesInformation(
                         v10->pSecurityAttributes,
                         *((_KTHREAD **)v11 + 97)) )
                  {
                    v6 = 1;
                  }
                }
              }
            }
          }
        }
      }
    }
    v3 = Equal;
  }
LABEL_27:
  if( v25 )
    SepReleaseOrderedReadLocks(v10, (_TOKEN *)v11);
  if( v10 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v10);
  if( v11 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v11);
  *v3 = v6;
  return InformationToken;
}

Referenced by: