RtlIsSandboxedTokenHandle

BOOL __stdcall RtlIsSandboxedTokenHandle(_HANDLE TokenHandle, _KPROCESSOR_MODE PreviousMode){
  __int128 *v2; 
  char v3; 
  NTSTATUS v5; 
  INT64 TokenType; 
  VOID *Handle; 
  PVOID Object; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 v10; 
  __int128 v11; 
  __int64 v12; 
  int v13; 

  Handle = 0i64;
  v2 = 0i64;
  v12 = 0i64;
  v13 = 0;
  v3 = 1;
  v10 = 0i64;
  v11 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( *(_QWORD *)&TokenHandle )
  {
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = 0i64;
    ObjectAttributes.SecurityDescriptor = 0i64;
    ObjectAttributes.SecurityQualityOfService = &v12;
    LODWORD(TokenType) = 2;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 512;
    v12 = 0x20000000Ci64;
    LOWORD(v13) = 1;
    if( ZwDuplicateToken(*(UINT64 *)&TokenHandle, 8i64, (INT64)&ObjectAttributes, 0, TokenType, (UINT64)&Handle) < 0 )
      goto LABEL_4;
    Object = 0i64;
    *((_QWORD *)&v11 + 1) = KeGetCurrentThread()->ApcState.Process->UniqueProcessId;
    v5 = ObReferenceObjectByHandle(Handle, 8ui64, (_OBJECT_TYPE *)SeTokenObjectType, 0, &Object, 0i64);
    *(_QWORD *)&v11 = Object;
    if( v5 < 0 )
      goto LABEL_4;
    *(_QWORD *)&v10 = 0i64;
    v2 = &v10;
  }
  v3 = RtlIsSandboxedToken((_KNOWN_CONTROLLER_TYPE)v2);
  if( v2 )
    ObfDereferenceObjectWithTag(*((VOID **)v2 + 2), 0x746C6644ui64);
LABEL_4:
  if( Handle )
    ZwClose((_HANDLE)Handle);
  return v3;
}

Referenced by: