NtAdjustGroupsToken

NTSTATUS __stdcall NtAdjustGroupsToken(
        _HANDLE TokenHandle,
        BOOL ResetToDefault,
        PTOKEN_GROUPS NewState,
        ULONG BufferLength,
        PTOKEN_GROUPS PreviousState,
        PULONG ReturnLength){
  PTOKEN_GROUPS v6; 
  VOID *v8; 
  VOID *v9; 
  char PreviousMode; 
  __int64 v11; 
  _TOKEN_GROUPS *v12; 
  NTSTATUS result; 
  int v14; 
  INT64 v15; 
  _ETHREAD *CurrentThread; 
  PERESOURCE *v17; 
  _SID_AND_ATTRIBUTES *v18; 
  _TOKEN *v19; 
  NTSTATUS v20; 
  signed __int32 v21[8]; 
  UINT64 CaptureBufferLength; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  VOID *SidBuffer; 
  INT8 RequestorMode; 
  UINT64 ChangeCount; 
  NTSTATUS v27; 
  UINT64 GroupCount; 
  PVOID Object; 
  _SID_AND_ATTRIBUTES *NewStatea; 
  UINT8 ChangesMade; 
  ULONG v32; 

  v32 = BufferLength;
  v6 = NewState;
  v8 = *(VOID **)&TokenHandle;
  GroupCount = 0i64;
  NewStatea = 0i64;
  ChangeCount = 0i64;
  ChangesMade = 0;
  v9 = 0i64;
  if( !ResetToDefault && !NewState )
    return -1073741811;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  RequestorMode = PreviousMode;
  if( PreviousMode )
  {
    if( ResetToDefault )
    {
      v11 = 0x7FFFFFFF0000i64;
    }
    else
    {
      if( ((unsigned __int8)NewState & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v11 = 0x7FFFFFFF0000i64;
    }
    v12 = PreviousState;
    if( PreviousState )
    {
      ProbeForWrite((UINT64)PreviousState, BufferLength, 4i64);
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v11 = (__int64)ReturnLength;
      *(_DWORD *)v11 = *(_DWORD *)v11;
    }
  }
  else
  {
    v12 = PreviousState;
  }
  if( ResetToDefault
    || (LODWORD(GroupCount) = v6->GroupCount,
        LODWORD(CaptureBufferLength) = 0,
        LOBYTE(NewState) = PreviousMode,
        result = SeCaptureSidAndAttributesArray(
                   v6->Groups,
                   (unsigned int)GroupCount,
                   (INT64)NewState,
                   0i64,
                   CaptureBufferLength,
                   (POOL_TYPE)HandleInformation,
                   (UINT8)SidBuffer,
                   &NewStatea,
                   (UINT64 *)((char *)&GroupCount + 4)),
        v27 = result,
        result >= 0) )
  {
    Object = 0i64;
    v14 = ObReferenceObjectByHandle(
            v8,
            v12 != 0i64 ? 72 : 64,
            (_OBJECT_TYPE *)SeTokenObjectType,
            PreviousMode,
            &Object,
            0i64);
    if( v14 < 0 )
    {
      if( NewStatea )
        SeReleaseLuidAndAttributesArray((_LUID_AND_ATTRIBUTES *)NewStatea, PreviousMode);
      return v14;
    }
    else
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      v17 = (PERESOURCE *)Object;
      ExAcquireResourceExclusiveLite(*((_QWORD *)Object + 6), 1, v15);
      _InterlockedOr(v21, 0);
      v18 = NewStatea;
      v19 = (_TOKEN *)Object;
      v20 = SepAdjustGroups(
              (_TOKEN *)Object,
              0,
              ResetToDefault,
              (unsigned int)GroupCount,
              NewStatea,
              v12,
              0i64,
              &ChangeCount,
              (UINT64 *)((char *)&ChangeCount + 4),
              &ChangesMade);
      v27 = v20;
      if( v12 )
        *ReturnLength = ChangeCount;
      if( v20 < 0 )
        goto LABEL_24;
      if( !v12 )
      {
LABEL_20:
        v27 = SepAdjustGroups(
                v19,
                1u,
                ResetToDefault,
                (unsigned int)GroupCount,
                v18,
                v12,
                v9,
                &ChangeCount,
                (UINT64 *)((char *)&ChangeCount + 4),
                &ChangesMade);
        if( v12 )
          v12->GroupCount = HIDWORD(ChangeCount);
        if( ChangesMade )
          v19->ModifiedId = (_LUID)(ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement));
LABEL_24:
        _InterlockedOr(v21, 0);
        ExReleaseResourceLite(v17[6]);
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
        if( NewStatea )
          SeReleaseLuidAndAttributesArray((_LUID_AND_ATTRIBUTES *)NewStatea, PreviousMode);
        return v27;
      }
      if( (unsigned int)ChangeCount <= v32 )
      {
        v9 = (VOID *)(((unsigned __int64)&v12->Groups[0].Sid + (unsigned int)(16 * HIDWORD(ChangeCount)) + 3) & 0xFFFFFFFFFFFFFFFCui64);
        goto LABEL_20;
      }
      _InterlockedOr(v21, 0);
      ExReleaseResourceLite(v17[6]);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      if( NewStatea )
        SeReleaseLuidAndAttributesArray((_LUID_AND_ATTRIBUTES *)NewStatea, PreviousMode);
      return -1073741789;
    }
  }
  return result;
}

Referenced by: