NtSetInformationToken
NTSTATUS __fastcall NtSetInformationToken(UINT64 a1, INT64 a2, UINT64 *a3, UINT64 a4){
unsigned int v4;
int v6;
NTSTATUS v8;
char PreviousMode;
__int64 v10;
UINT64 v11;
NTSTATUS result;
INT64 v13;
VOID *v14;
INT64 v15;
PVOID v16;
int v17;
int v18;
int v19;
int v20;
int v21;
NTSTATUS v22;
_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION *v23;
bool v24;
_ETHREAD *CurrentThread;
PERESOURCE *v26;
INT64 v27;
_TOKEN_SECURITY_ATTRIBUTE_OPERATION *v28;
_DWORD *v29;
int v30;
int v31;
int v32;
int v33;
int v34;
int v35;
int v36;
_ETHREAD *v37;
char v38;
INT64 v39;
VOID *v40;
INT64 v41;
_ETHREAD *v42;
_ERESOURCE *v43;
_ADAPTER_OBJECT *v44;
NTSTATUS v45;
unsigned int v46;
INT64 v47;
_ETHREAD *v48;
PVOID v49;
_LUID_AND_ATTRIBUTES *v50;
_LUID Luid;
int v52;
unsigned __int8 *v53;
INT64 v54;
int v55;
unsigned int *v56;
unsigned int v57;
_ETHREAD *v58;
char *v59;
INT64 *v60;
INT64 *v61;
INT64 v62;
unsigned __int8 *v63;
int v64;
unsigned int *v65;
unsigned int v66;
int v67;
unsigned int *v68;
void *v69;
void *v70;
void *v71;
INT64 v72;
unsigned int v73;
_ACL *v74;
_ETHREAD *v75;
PERESOURCE *v76;
_TOKEN *v77;
UINT64 v78;
VOID *v79;
INT64 v80;
_ACL *DefaultDacl;
_UNICODE_STRING *v82;
_ACL *v83;
int v84;
INT64 v85;
_ETHREAD *v86;
PERESOURCE *v87;
_QWORD *v88;
INT64 v89;
_ETHREAD *v90;
int v91;
unsigned int v92;
INT64 v93;
unsigned int v94;
_ETHREAD *v95;
PADAPTER_OBJECT v96;
char v97;
_ADAPTER_OBJECT *v98;
_ETHREAD *v99;
PERESOURCE *v100;
_QWORD *v101;
int v102;
unsigned int v103;
INT64 v104;
_ETHREAD *v105;
_QWORD *v106;
_SEP_AUDIT_POLICY *v107;
INT64 v108;
unsigned int v109;
_ETHREAD *v110;
PERESOURCE *v111;
_TOKEN *v112;
__int64 v113;
_ADAPTER_OBJECT *v114;
int v115;
INT64 v116;
_ETHREAD *v117;
PERESOURCE *v118;
unsigned int v119;
signed __int32 v120[8];
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
_ACL **CapturedAcl;
UINT64 *AlignedAclSize;
PVOID Token;
NTSTATUS v126;
char v127;
CHAR RequestorMode;
UINT64 NewLength;
_ACL *PAcl;
VOID *Group;
PVOID Sid1;
PADAPTER_OBJECT DmaAdapter;
_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION *CapturedAttributesAndOperations;
_TOKEN_AUDIT_POLICY *CapturedPolicy;
UINT64 v136;
_TOKEN_MANDATORY_POLICY MandatoryPolicy;
unsigned int v138;
UINT64 AlignedArraySize;
_ACL *OldDefaultDacl;
_LUID_AND_ATTRIBUTES *CapturedArray;
PERESOURCE *v142;
unsigned int v143;
unsigned int v144;
unsigned int v145;
unsigned int v146;
unsigned int v147;
UINT64 v148;
VOID *v149;
v4 = a4;
v6 = a2;
v8 = 0;
v127 = 0;
LODWORD(NewLength) = 0;
LODWORD(v136) = 0;
Sid1 = 0i64;
Group = 0i64;
PAcl = 0i64;
OldDefaultDacl = 0i64;
CapturedArray = 0i64;
LODWORD(AlignedArraySize) = 0;
PreviousMode = KeGetCurrentThread()->PreviousMode;
RequestorMode = PreviousMode;
if( PreviousMode && (_DWORD)a4 )
{
if( ((unsigned __int8)a3 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)a3 + (unsigned int)a4 > 0x7FFFFFFF0000i64 || (UINT64 *)((char *)a3 + (unsigned int)a4) < a3 )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( (unsigned int)a2 > 0x2D )
return -1073741821;
v10 = 0x24800F8B5070i64;
if( !_bittest64(&v10, (int)a2) )
return -1073741821;
v11 = 128i64;
if( v6 == 12 )
{
v11 = 384i64;
}
else if( v6 == 19 )
{
v11 = 136i64;
}
Token = 0i64;
result = ObReferenceObjectByHandle((VOID *)a1, v11, (_OBJECT_TYPE *)SeTokenObjectType, PreviousMode, &Token, 0i64);
v16 = Token;
DmaAdapter = (PADAPTER_OBJECT)Token;
if( result >= 0 )
{
if( v6 > 23 )
{
v17 = v6 - 24;
if( v17 )
{
v18 = v17 - 1;
if( v18 )
{
v19 = v18 - 1;
if( v19 )
{
v20 = v19 - 1;
if( v20 )
{
v21 = v20 - 12;
if( !v21 )
{
CapturedAttributesAndOperations = 0i64;
if( a3 && v4 >= 0x10 )
{
v22 = SepCaptureTokenSecurityAttributesAndOperationsInformation(
(_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION *)a3,
PreviousMode,
&CapturedAttributesAndOperations);
if( v22 >= 0 )
{
LODWORD(HandleInformation) = 0;
wil_details_FeatureReporting_ReportUsageToService(
(wil_details_FeatureReportingCache *)&WheapErrorSourceTable + 124,
0xFC13FCui64,
0i64,
0i64,
(FEATURE_LOGGED_TRAITS *)&Feature_PdttSupport_logged_traits,
(INT64)HandleInformation);
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
v22 = -1073741727;
v126 = v22;
if( v22 >= 0 )
{
v23 = CapturedAttributesAndOperations;
v24 = SepShouldSetDelinkFlags(
*((_TOKEN_SECURITY_ATTRIBUTE_OPERATION **)CapturedAttributesAndOperations + 1),
*(_TOKEN_SECURITY_ATTRIBUTES_INFORMATION **)CapturedAttributesAndOperations) != 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v26 = (PERESOURCE *)Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, v27);
_InterlockedOr(v120, 0);
v28 = (_TOKEN_SECURITY_ATTRIBUTE_OPERATION *)*((_QWORD *)v23 + 1);
v29 = Token;
v126 = AuthzBasepSetSecurityAttributesToken(
*((_FADT **)Token + 97),
v28,
*(_TOKEN_SECURITY_ATTRIBUTES_INFORMATION **)CapturedAttributesAndOperations);
if( v126 >= 0 && v24 )
v29[50] |= 0x20000u;
*((_QWORD *)v29 + 7) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v26[6]);
KeLeaveCriticalRegion();
SepReleaseTokenSecurityAttributesAndOperationsInformation(
CapturedAttributesAndOperations,
PreviousMode);
v30 = v126;
goto LABEL_28;
}
SepReleaseTokenSecurityAttributesAndOperationsInformation(
CapturedAttributesAndOperations,
PreviousMode);
}
v30 = v22;
goto LABEL_42;
}
LABEL_146:
v30 = -1073741820;
goto LABEL_42;
}
v115 = v21 - 3;
if( v115 )
{
if( v115 == 3 )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
{
if( v4 != 4 )
goto LABEL_146;
v145 = *(_DWORD *)a3;
if( !v145 && (*((_DWORD *)v16 + 50) & 0x80000) != 0 )
{
v117 = (_ETHREAD *)KeGetCurrentThread();
--v117->Tcb.KernelApcDisable;
v118 = (PERESOURCE *)Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, v116);
_InterlockedOr(v120, 0);
*((_DWORD *)v16 + 50) &= ~0x80000u;
*((_QWORD *)Token + 7) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v118[6]);
KeLeaveCriticalRegion();
v16 = Token;
}
HalPutDmaAdapter((PADAPTER_OBJECT)v16);
return 0;
}
LABEL_150:
v30 = -1073741727;
goto LABEL_42;
}
return -1073741811;
}
if( v4 != 4 )
goto LABEL_146;
v119 = *(_DWORD *)a3;
v146 = *(_DWORD *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
goto LABEL_150;
v45 = SeSetPrivateNameSpaceToken(v16, v119);
}
else
{
if( v4 != 4 )
goto LABEL_146;
MandatoryPolicy.Policy = *(_DWORD *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
goto LABEL_150;
if( *((_BYTE *)v16 + 204) )
{
v30 = -1073741525;
goto LABEL_42;
}
v45 = SeSetMandatoryPolicyToken(v16, &MandatoryPolicy);
}
LABEL_50:
v30 = v45;
goto LABEL_42;
}
if( v4 != 4 )
goto LABEL_146;
v138 = *(_DWORD *)a3;
if( v138 && !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
goto LABEL_150;
v99 = (_ETHREAD *)KeGetCurrentThread();
--v99->Tcb.KernelApcDisable;
v100 = (PERESOURCE *)Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, (INT64)v14);
_InterlockedOr(v120, 0);
v101 = Token;
v102 = *((_DWORD *)Token + 50);
if( v138 )
v103 = v102 | 0x1000;
else
v103 = v102 & 0xFFFFEFFF;
*((_DWORD *)Token + 50) = v103;
v101[7] = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v100[6]);
KeLeaveCriticalRegion();
v30 = 0;
LABEL_28:
v16 = Token;
LABEL_42:
v44 = (_ADAPTER_OBJECT *)v16;
LABEL_43:
HalPutDmaAdapter(v44);
return v30;
}
if( v4 < 0x10 )
goto LABEL_146;
LODWORD(Object) = 0;
LOBYTE(v14) = PreviousMode;
v45 = SeCaptureSidAndAttributesArray(
a3,
1ui64,
(INT64)v14,
0i64,
(UINT64)Object,
(POOL_TYPE)HandleInformation,
(UINT8)CapturedAcl,
(_SID_AND_ATTRIBUTES **)&CapturedArray,
&AlignedArraySize);
v126 = v45;
if( v45 < 0 )
goto LABEL_50;
v50 = CapturedArray;
Luid = CapturedArray->Luid;
v52 = *(_DWORD *)(*(_QWORD *)&CapturedArray->Luid + 2i64) - *(_DWORD *)((char *)SeUntrustedMandatorySid + 2);
if( !v52 )
v52 = *(unsigned __int16 *)(*(_QWORD *)&Luid + 6i64) - *((unsigned __int16 *)SeUntrustedMandatorySid + 3);
if( !v52 )
{
LODWORD(v53) = RtlSubAuthorityCountSid(*(_QWORD *)&CapturedArray->Luid);
v55 = *v53;
if( !(_BYTE)v55 )
{
v57 = 0;
LABEL_68:
v58 = (_ETHREAD *)KeGetCurrentThread();
--v58->Tcb.KernelApcDisable;
v142 = (PERESOURCE *)Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, v54);
_InterlockedOr(v120, 0);
v59 = (char *)Token;
SepLocateTokenIntegrity();
v61 = v60;
if( v60 )
{
v62 = *v60;
LODWORD(v63) = RtlSubAuthorityCountSid(*v60);
v64 = *v63;
if( (_BYTE)v64 )
{
LODWORD(v65) = RtlSubAuthoritySid(v62, (unsigned int)(v64 - 1));
v66 = *v65;
}
else
{
v66 = 0;
}
if( v57 <= v66 )
{
LABEL_74:
v67 = *(unsigned __int8 *)(*v61 + 1);
if( (_BYTE)v67 )
{
LODWORD(v68) = RtlSubAuthoritySid(*v61, (unsigned int)(v67 - 1));
*v68 = v57;
if( v57 < 0x3000 )
{
*((_QWORD *)v59 + 9) &= 0xFFFFFFEEDFE9F97Bui64;
*((_QWORD *)v59 + 10) &= 0xFFFFFFEEDFE9F97Bui64;
}
if( v57 < 0x2000 )
{
*((_QWORD *)v59 + 9) &= 0x202800000ui64;
*((_QWORD *)v59 + 10) &= 0x202800000ui64;
*((_DWORD *)v59 + 50) &= ~0x2000u;
}
else
{
if( (*((_DWORD *)v59 + 50) & 0x4000) != 0 )
{
SepRemoveAceFromTokenDefaultDacl((_TOKEN *)v59, *((VOID **)v59 + 98));
*((_DWORD *)v59 + 50) &= ~0x4000u;
v69 = (void *)*((_QWORD *)v59 + 98);
if( v69 )
{
ExFreePoolWithTag(v69, 0);
*((_QWORD *)v59 + 98) = 0i64;
}
v70 = (void *)*((_QWORD *)v59 + 99);
if( v70 )
{
ExFreePoolWithTag(v70, 0);
*((_QWORD *)v59 + 99) = 0i64;
*((_DWORD *)v59 + 200) = 0;
memset(v59 + 808, 0i64, 0x110u);
}
v71 = (void *)*((_QWORD *)v59 + 135);
if( v71 )
{
SepDereferenceLowBoxNumberEntry(*((unsigned int *)v59 + 30), v71);
*((_QWORD *)v59 + 135) = 0i64;
}
v72 = *((_QWORD *)v59 + 136);
if( v72 )
{
SepDereferenceCachedHandlesEntry(*((_QWORD *)v59 + 27), v72);
*((_QWORD *)v59 + 136) = 0i64;
}
}
*((_DWORD *)v59 + 50) |= 0x2000u;
}
*((_QWORD *)v59 + 7) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
v30 = 0;
}
else
{
v30 = -1073741811;
}
goto LABEL_89;
}
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
{
if( !v59[204] )
goto LABEL_74;
v30 = -1073741525;
}
else
{
v30 = -1073741727;
}
}
else
{
v30 = -1073740730;
}
LABEL_89:
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v142[6]);
KeLeaveCriticalRegion();
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
SeReleaseLuidAndAttributesArray(CapturedArray, PreviousMode);
return v30;
}
LODWORD(v56) = RtlSubAuthoritySid(*(_QWORD *)&Luid, (unsigned int)(v55 - 1));
v57 = *v56;
if( *v56 <= 0x4000 )
goto LABEL_68;
}
HalPutDmaAdapter((PADAPTER_OBJECT)v16);
SeReleaseLuidAndAttributesArray(v50, PreviousMode);
return -1073740730;
}
if( v4 != 4 )
goto LABEL_146;
v147 = *(_DWORD *)a3;
SeSetVirtualizationToken(Token, v147);
LABEL_41:
v30 = 0;
goto LABEL_42;
}
if( v6 == 23 )
{
if( v4 != 4 )
goto LABEL_146;
HIDWORD(v136) = *(_DWORD *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreateTokenPrivilege, PreviousMode) )
goto LABEL_150;
v90 = (_ETHREAD *)KeGetCurrentThread();
--v90->Tcb.KernelApcDisable;
v87 = (PERESOURCE *)Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, v89);
_InterlockedOr(v120, 0);
v88 = Token;
v91 = *((_DWORD *)Token + 50);
if( HIDWORD(v136) )
v92 = v91 | 0x200;
else
v92 = v91 & 0xFFFFFDFF;
*((_DWORD *)Token + 50) = v92;
goto LABEL_115;
}
v31 = v6 - 4;
if( v31 )
{
v32 = v31 - 1;
if( v32 )
{
v33 = v32 - 1;
if( v33 )
{
v34 = v33 - 6;
if( v34 )
{
v35 = v34 - 2;
if( !v35 )
{
if( v4 != 4 )
goto LABEL_146;
v46 = *(_DWORD *)a3;
v143 = *(_DWORD *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
goto LABEL_150;
if( !v46 )
{
v48 = (_ETHREAD *)KeGetCurrentThread();
--v48->Tcb.KernelApcDisable;
v49 = Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, v47);
_InterlockedOr(v120, 0);
v16 = Token;
if( (*((_DWORD *)Token + 50) & 0x20) == 0 )
{
if( SeTokenLeakTracking )
SepRemoveTokenLogonSession((_TOKEN *)Token);
v30 = SepStopReferencingLogonSession((_TOKEN *)v16);
v126 = v30;
if( v30 < 0 )
goto LABEL_42;
}
_InterlockedOr(v120, 0);
v43 = (_ERESOURCE *)*((_QWORD *)v49 + 6);
LABEL_40:
ExReleaseResourceLite(v43);
KeLeaveCriticalRegion();
v16 = Token;
goto LABEL_41;
}
LABEL_149:
v30 = -1073741811;
goto LABEL_42;
}
v36 = v35 - 2;
if( !v36 )
{
CapturedPolicy = 0i64;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
goto LABEL_150;
v37 = (_ETHREAD *)KeGetCurrentThread();
--v37->Tcb.KernelApcDisable;
v16 = Token;
ExAcquireResourceSharedLite(*((_QWORD *)Token + 6), 1);
v38 = *((_BYTE *)v16 + 118);
ExReleaseResourceLite(*((PERESOURCE *)v16 + 6));
KeLeaveCriticalRegion();
if( !v38 )
{
if( a3 )
{
LOBYTE(v39) = PreviousMode;
v30 = SepCaptureAuditPolicy(
(_TOKEN_AUDIT_POLICY *)a3,
v39,
v40,
v41,
(INT64)Object,
(INT64)HandleInformation,
&CapturedPolicy,
(INT64)AlignedAclSize);
v126 = v30;
if( v30 < 0 )
goto LABEL_42;
v105 = (_ETHREAD *)KeGetCurrentThread();
--v105->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite(*((_QWORD *)v16 + 6), 1, v104);
_InterlockedOr(v120, 0);
*((_BYTE *)v16 + 118) = 2;
v106 = Token;
v107 = (_SEP_AUDIT_POLICY *)((char *)Token + 88);
*(_TOKEN_AUDIT_POLICY *)((char *)Token + 88) = *CapturedPolicy;
v106[7] = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v120, 0);
ExReleaseResourceLite(*((PERESOURCE *)v16 + 6));
KeLeaveCriticalRegion();
SepModifyTokenPolicyCounter(v107, 1u);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
SepReleaseAuditPolicy(CapturedPolicy, PreviousMode);
return 0;
}
v42 = (_ETHREAD *)KeGetCurrentThread();
--v42->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite(*((_QWORD *)v16 + 6), 1, (INT64)v40);
_InterlockedOr(v120, 0);
*((_BYTE *)v16 + 118) = 1;
*((_QWORD *)Token + 7) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v120, 0);
v43 = (_ERESOURCE *)*((_QWORD *)v16 + 6);
goto LABEL_40;
}
goto LABEL_149;
}
v84 = v36 - 1;
if( v84 )
{
if( v84 != 2 )
return -1073741811;
if( v4 != 8 )
goto LABEL_146;
v149 = (VOID *)*a3;
v45 = SepLinkLogonSessions((_TOKEN *)Token, v149, PreviousMode);
goto LABEL_50;
}
if( v4 != 8 )
goto LABEL_146;
v148 = *a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
goto LABEL_150;
v86 = (_ETHREAD *)KeGetCurrentThread();
--v86->Tcb.KernelApcDisable;
v87 = (PERESOURCE *)Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, v85);
_InterlockedOr(v120, 0);
v88 = Token;
if( !*((_QWORD *)Token + 28) )
*((_QWORD *)Token + 28) = v148;
LABEL_115:
v88[7] = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v87[6]);
KeLeaveCriticalRegion();
v30 = 0;
goto LABEL_28;
}
if( v4 == 4 )
{
v73 = *(_DWORD *)a3;
v144 = *(_DWORD *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
goto LABEL_150;
v45 = SeSetSessionIdToken(v16, v73);
goto LABEL_50;
}
LABEL_170:
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
return -1073741820;
}
if( v4 < 8 )
goto LABEL_170;
v74 = (_ACL *)*a3;
PAcl = v74;
if( v74 )
{
LODWORD(Object) = 1;
LOBYTE(v13) = PreviousMode;
v30 = SeCaptureAcl(v74, v13, v14, v15, (INT64)Object, (INT64)HandleInformation, &PAcl, &NewLength);
v126 = v30;
}
else
{
LODWORD(NewLength) = 0;
v30 = 0;
v126 = 0;
}
if( v30 < 0 )
goto LABEL_42;
v75 = (_ETHREAD *)KeGetCurrentThread();
--v75->Tcb.KernelApcDisable;
v76 = (PERESOURCE *)Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, (INT64)v14);
_InterlockedOr(v120, 0);
v77 = (_TOKEN *)Token;
v78 = (_DWORD)NewLength + 8 + 4 * (unsigned int)*(unsigned __int8 *)(*((_QWORD *)Token + 21) + 1i64);
LODWORD(NewLength) = v78;
if( (unsigned int)v78 > *((_DWORD *)Token + 34) )
{
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v76[6]);
KeLeaveCriticalRegion();
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
if( PAcl )
SeReleaseAcl(PAcl, PreviousMode);
return -1073741671;
}
else
{
v126 = SepExpandDynamic((_TOKEN *)Token, v78);
if( v126 >= 0 )
{
DefaultDacl = v77->DefaultDacl;
if( !DefaultDacl
|| (LODWORD(Object) = 1,
v126 = SeCaptureAcl(
DefaultDacl,
0i64,
v79,
v80,
(INT64)Object,
(INT64)HandleInformation,
&OldDefaultDacl,
&v136),
v126 >= 0) )
{
SepFreeDefaultDacl(v77);
v83 = PAcl;
if( PAcl )
SepAppendDefaultDacl(v77, PAcl);
SeTokenDefaultDaclChangedAuditAlarm(v82, v77, (VOID *)a1, OldDefaultDacl, v83);
v77->ModifiedId = (_LUID)(ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement));
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v76[6]);
KeLeaveCriticalRegion();
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
if( PAcl )
SeReleaseAcl(PAcl, PreviousMode);
if( OldDefaultDacl )
SeReleaseAcl(OldDefaultDacl, 0);
return 0;
}
}
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v76[6]);
KeLeaveCriticalRegion();
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
if( PAcl )
SeReleaseAcl(PAcl, PreviousMode);
return v126;
}
}
else
{
if( v4 < 8 )
goto LABEL_170;
Group = (VOID *)*a3;
CapturedAcl = (_ACL **)&Group;
LOBYTE(HandleInformation) = 1;
LOBYTE(v13) = PreviousMode;
v30 = SeCaptureSid(Group, v13, (CHAR)v14, v15);
v126 = v30;
v44 = (_ADAPTER_OBJECT *)v16;
if( v30 < 0 )
goto LABEL_43;
if( SepIdAssignableAsGroup(v16, Group) )
{
v109 = 4 * *((unsigned __int8 *)Group + 1) + 8;
LODWORD(NewLength) = v109;
v110 = (_ETHREAD *)KeGetCurrentThread();
--v110->Tcb.KernelApcDisable;
v111 = (PERESOURCE *)Token;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, v108);
_InterlockedOr(v120, 0);
v112 = (_TOKEN *)Token;
v113 = *((_QWORD *)Token + 23);
if( v113 )
{
v109 += *(unsigned __int16 *)(v113 + 2);
LODWORD(NewLength) = v109;
}
if( v109 <= *((_DWORD *)Token + 34) )
{
v126 = SepExpandDynamic((_TOKEN *)Token, (unsigned int)NewLength);
if( v126 >= 0 )
{
SepFreePrimaryGroup(v112);
SepAppendPrimaryGroup(v112, Group);
v112->ModifiedId = (_LUID)(ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement));
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v111[6]);
KeLeaveCriticalRegion();
}
else
{
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v111[6]);
KeLeaveCriticalRegion();
v8 = v126;
}
}
else
{
_InterlockedOr(v120, 0);
ExReleaseResourceLite(v111[6]);
KeLeaveCriticalRegion();
v8 = -1073741671;
}
v16 = Token;
}
else
{
v8 = -1073741733;
}
HalPutDmaAdapter((PADAPTER_OBJECT)v16);
SeReleaseSid(Group, PreviousMode, 1u);
return v8;
}
}
else
{
if( v4 < 8 )
goto LABEL_170;
Sid1 = (PVOID)*a3;
CapturedAcl = (_ACL **)&Sid1;
LOBYTE(HandleInformation) = 1;
LOBYTE(v13) = PreviousMode;
v30 = SeCaptureSid(Sid1, v13, (CHAR)v14, v15);
v126 = v30;
if( v30 < 0 )
goto LABEL_42;
v94 = 0;
v95 = (_ETHREAD *)KeGetCurrentThread();
--v95->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite(*((_QWORD *)Token + 6), 1, v93);
_InterlockedOr(v120, 0);
v96 = DmaAdapter;
while( 1 )
{
if( v94 >= HIDWORD(v96->AdapterObject.SpinLock) )
{
_InterlockedOr(v120, 0);
v114 = DmaAdapter;
ExReleaseResourceLite((PERESOURCE)DmaAdapter->AdapterObject.ScatterTranslations);
KeLeaveCriticalRegion();
HalPutDmaAdapter(v114);
SeReleaseSid(Sid1, PreviousMode, 1u);
return -1073741734;
}
BYTE4(NewLength) = RtlEqualSid(Sid1, *((PVOID *)&v96->MasterAdapter->AdapterObject.DmaHeader.Version + 2 * v94));
if( BYTE4(NewLength) )
break;
++v94;
}
if( SepIdAssignableAsOwner((_TOKEN *)v96, v94) )
{
*(_DWORD *)&v96->AdapterObject.IsMasterAdapter = v94;
v97 = 1;
v127 = 1;
v126 = 0;
}
else
{
v126 = -1073741734;
v97 = v127;
}
if( v97 )
{
v142 = (PERESOURCE *)(ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement));
v96->AdapterObject.ContiguousTranslationEnd.Buffer = (_HALP_DMA_TRANSLATION_BUFFER *)v142;
}
_InterlockedOr(v120, 0);
v98 = DmaAdapter;
ExReleaseResourceLite((PERESOURCE)DmaAdapter->AdapterObject.ScatterTranslations);
KeLeaveCriticalRegion();
HalPutDmaAdapter(v98);
SeReleaseSid(Sid1, PreviousMode, 1u);
return v126;
}
}
return result;
}Referenced by:
No references.