SeTokenIsWriteRestricted
UINT8 __stdcall SeTokenIsWriteRestricted(VOID *Token){ return(*((_DWORD *)Token + 50) & 8) != 0; }
Referenced by:
NtCompareTokens
NtImpersonateAnonymousToken
SeTokenCanImpersonate
SepNewTokenAsRestrictedAsProcessToken