RtlIsSandboxedToken

_KNOWN_CONTROLLER_TYPE __stdcall RtlIsSandboxedToken(_KNOWN_CONTROLLER_TYPE a1){
  CHAR v1; 
  CHAR AccessMode; 
  char v3; 
  _SECURITY_SUBJECT_CONTEXT *v4; 
  _SECURITY_SUBJECT_CONTEXT *v5; 
  _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  _KTRANSACTION *v7; 
  _SECURITY_SUBJECT_CONTEXT *v8; 
  VOID *ClientToken; 
  UINT64 DesiredAccess; 
  UINT64 PreviouslyGrantedAccess; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  VOID *TokenInformation; 
  INT64 AccessStatus; 
  UINT64 GrantedAccess; 

  AccessMode = v1;
  v3 = 0;
  v4 = *(_SECURITY_SUBJECT_CONTEXT **)&a1;
  LODWORD(TokenInformation) = 0;
  v5 = 0i64;
  LODWORD(GrantedAccess) = 0;
  LODWORD(AccessStatus) = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( v1 )
  {
    if( !*(_QWORD *)&a1 )
      SeCaptureSubjectContext((INT64)&SubjectContext);
    p_SubjectContext = &SubjectContext;
    if( v4 )
      p_SubjectContext = v4;
    LODWORD(PreviouslyGrantedAccess) = 0;
    v5 = p_SubjectContext;
    LODWORD(DesiredAccess) = 0x20000;
    if( SeAccessCheckWithHint(
           SeMediumDaclSd,
           8ui64,
           p_SubjectContext,
           0i64,
           DesiredAccess,
           PreviouslyGrantedAccess,
           0i64,
           (_GENERIC_MAPPING *)&RtlpRestrictedMapping,
           AccessMode,
           &GrantedAccess,
           &AccessStatus) )
    {
      if( !ext_ms_win_ntos_tm_l1_1_0_TmIsKTMCommitCoordinator(v7) )
        goto LABEL_8;
      ClientToken = p_SubjectContext->ClientToken;
      if( !p_SubjectContext->ClientToken )
        ClientToken = p_SubjectContext->PrimaryToken;
      if( SeQueryInformationToken(ClientToken, TokenIsAppContainer, &TokenInformation) >= 0
        && !(_DWORD)TokenInformation )
      {
LABEL_8:
        v3 = 1;
      }
    }
  }
  else
  {
    v3 = 1;
  }
  v8 = &SubjectContext;
  if( v5 == &SubjectContext )
    LODWORD(v8) = (unsigned int)SeReleaseSubjectContext(v5);
  LOBYTE(v8) = v3 != 1;
  return(int)v8;
}

Referenced by: