SeMakeSystemToken

VOID *__stdcall SeMakeSystemToken(){
  __int64 v0; 
  unsigned int v1; 
  signed __int64 v2; 
  unsigned int v3; 
  VOID *TokenSource; 
  VOID *SystemToken; 
  unsigned int v6; 
  int v7; 
  unsigned int v8; 
  unsigned int v9; 
  VOID **PoolWithTag; 
  UINT64 v11; 
  _ACL *v12; 
  unsigned int v13; 
  VOID **v14; 
  UINT64 v15; 
  _ACL *v16; 
  VOID **v17; 
  VOID **v18; 
  _OBJECT_ATTRIBUTES *v19; 
  _LUID *v20; 
  __int64 *v22; 
  __int64 v23; 
  __int64 v24; 
  _ACL *v25; 
  int v26[8]; 
  __int64 AceType; 
  UINT64 AccessMask; 
  _LUID_AND_ATTRIBUTES *Privileges; 
  VOID *PrimaryGroup; 
  _ACL *DefaultDacl; 
  _TOKEN_SOURCE *v32; 
  UINT8 v33; 
  _TOKEN_MANDATORY_POLICY MandatoryPolicy; 
  __int64 v35; 
  UINT64 GroupsLength; 
  VOID *TokenHandle; 
  _SID_AND_ATTRIBUTES PrivilegeCount; 
  __m128i si128; 
  _OBJECT_ATTRIBUTES ExpirationTime; 
  _LUID v41; 
  int v42; 
  _LUID v43; 
  int v44; 
  __int64 v45; 
  int v46; 
  _LUID v47; 
  int v48; 
  _LUID v49; 
  int v50; 
  _LUID v51; 
  int v52; 
  _LUID v53; 
  int v54; 
  _LUID v55; 
  int v56; 
  _LUID v57; 
  int v58; 
  _LUID v59; 
  int v60; 
  __int64 v61; 
  int v62; 
  _LUID v63; 
  int v64; 
  _LUID v65; 
  int v66; 
  __int64 v67; 
  int v68; 
  _LUID v69; 
  int v70; 
  _LUID v71; 
  int v72; 
  _LUID v73; 
  int v74; 
  _LUID v75; 
  int v76; 
  _LUID v77; 
  int v78; 
  _LUID v79; 
  int v80; 
  __int64 v81; 
  int v82; 
  __int64 v83; 
  int v84; 
  __int64 v85; 
  int v86; 
  _LUID v87; 
  int v88; 
  __int64 v89; 
  int v90; 
  __int64 v91; 
  int v92; 
  __int64 v93; 
  int v94; 
  _LUID v95; 
  int v96; 
  __int64 v97; 
  int v98; 
  _LUID v99; 
  int v100; 
  __int64 v101; 
  int v102; 
  PVOID Owner; 
  int v104; 
  PVOID v105; 
  int v106; 
  __int64 v107; 
  int v108; 
  __int64 v109; 
  int v110; 

  v0 = *(&ExBootDevicesRemovedEvent + 103);
  TokenHandle = 0i64;
  *(&PrivilegeCount.Attributes + 1) = 0;
  *(&ExpirationTime.Length + 1) = 0;
  MandatoryPolicy.Policy = 1;
  *(&ExpirationTime.Attributes + 1) = 0;
  GroupsLength = 0i64;
  v35 = 0i64;
  si128 = _mm_load_si128((const __m128i *)&_xmm);
  if( !*(&ExBootDevicesRemovedEvent + 103) || !**(&ExBootDevicesRemovedEvent + 103) )
  {
    RtlpTimeFieldsToTimeNoLeapSeconds(si128.m128i_i16, &GroupsLength);
    goto LABEL_6;
  }
  v1 = *(_DWORD *)(*(&ExBootDevicesRemovedEvent + 103) + 4i64);
  _InterlockedOr(v26, 0);
  if( !RtlpTimeFieldsToTimeNoLeapSeconds(si128.m128i_i16, &v35) )
    goto LABEL_6;
  v2 = v35;
  v3 = 0;
  if( !v1 )
    goto LABEL_5;
  v22 = (__int64 *)(v0 + 8);
  while( 1 )
  {
    v23 = *v22;
    if( *v22 >= 0 )
    {
      if( v2 < v23 + 10000000 )
      {
        if( v2 < v23 )
          goto LABEL_5;
        v2 = 2 * v2 - v23;
      }
      else
      {
        v2 += 10000000i64;
      }
      goto LABEL_18;
    }
    v24 = v23 & 0x7FFFFFFFFFFFFFFFi64;
    if( v2 < v24 + 10000000 )
      break;
    v2 -= 10000000i64;
LABEL_18:
    ++v3;
    ++v22;
    if( v3 >= v1 )
      goto LABEL_5;
  }
  if( v2 < v24 )
LABEL_5:
    GroupsLength = v2;
LABEL_6:
  TokenSource = SeAliasAdminsSid;
  SystemToken = SeLocalSystemSid;
  v106 = 7;
  v108 = 7;
  v105 = SeWorldSid;
  PrivilegeCount.Sid = SeLocalSystemSid;
  PrivilegeCount.Attributes = 0;
  Owner = SeAliasAdminsSid;
  v107 = SeAuthenticatedUsersSid;
  v109 = SeSystemMandatorySid;
  v104 = 14;
  v110 = 96;
  v6 = ((4 * *(unsigned __int8 *)(SeAuthenticatedUsersSid + 1) + 11) & 0xFFFFFFFC)
     + ((4 * *((unsigned __int8 *)SeWorldSid + 1) + 11) & 0xFFFFFFFC)
     + ((4 * *((unsigned __int8 *)SeAliasAdminsSid + 1) + 11) & 0xFFFFFFFC);
  v7 = *(unsigned __int8 *)(SeSystemMandatorySid + 1);
  v42 = 3;
  v44 = 0;
  v46 = 0;
  v48 = 3;
  v41 = SeTcbPrivilege;
  v8 = v6 + ((4 * v7 + 11) & 0xFFFFFFFC) + 16;
  v43 = SeCreateTokenPrivilege;
  v45 = SeTakeOwnershipPrivilege;
  v47 = SeCreatePagefilePrivilege;
  v49 = SeLockMemoryPrivilege;
  v51 = SeAssignPrimaryTokenPrivilege;
  v53 = SeIncreaseQuotaPrivilege;
  v55 = SeIncreaseBasePriorityPrivilege;
  v57 = SeCreatePermanentPrivilege;
  v59 = SeDebugPrivilege;
  v61 = SeAuditPrivilege;
  v63 = SeSecurityPrivilege;
  v65 = SeSystemEnvironmentPrivilege;
  v67 = SeChangeNotifyPrivilege;
  v69 = SeBackupPrivilege;
  v71 = SeRestorePrivilege;
  v50 = 3;
  v52 = 0;
  v54 = 0;
  v56 = 3;
  v58 = 3;
  v60 = 3;
  v62 = 3;
  v64 = 0;
  v66 = 0;
  v68 = 3;
  v70 = 0;
  v73 = SeShutdownPrivilege;
  v75 = SeLoadDriverPrivilege;
  v77 = SeProfileSingleProcessPrivilege;
  v79 = SeSystemtimePrivilege;
  v81 = SeUndockPrivilege;
  v83 = SeManageVolumePrivilege;
  v85 = SeImpersonatePrivilege;
  v87 = SeCreateGlobalPrivilege;
  v89 = SeTrustedCredManAccessPrivilege;
  v91 = SeRelabelPrivilege;
  v93 = SeIncreaseWorkingSetPrivilege;
  v95 = SeTimeZonePrivilege;
  v97 = SeCreateSymbolicLinkPrivilege;
  v99 = SeSystemProfilePrivilege;
  v78 = 3;
  v86 = 3;
  v88 = 3;
  v94 = 3;
  v96 = 3;
  v98 = 3;
  v100 = 3;
  v102 = 3;
  v101 = SeDelegateSessionUserImpersonatePrivilege;
  v72 = 0;
  v74 = 0;
  v76 = 0;
  v80 = 0;
  v82 = 0;
  v84 = 0;
  v90 = 0;
  v92 = 0;
  v9 = 4 * *((unsigned __int8 *)SeLocalSystemSid + 1) + 24;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v9, 1665230163i64);
  v12 = (_ACL *)PoolWithTag;
  if( PoolWithTag )
  {
    RtlCreateAcl((PACL)PoolWithTag, (_ACL)v9, 2ui64, v11);
    v13 = 4 * *((unsigned __int8 *)SeProcTrustWinTcbSid + 1) + 24;
    v14 = ExAllocatePoolWithTag(1ui64, v13, 1665230163i64);
    v16 = (_ACL *)v14;
    if( v14 )
    {
      RtlCreateAcl((PACL)v14, (_ACL)v13, 2ui64, v15);
      RtlAddAccessAllowedAce(v12, 2ui64, 983551, SeLocalSystemSid);
      LODWORD(AccessMask) = 131096;
      RtlAddProcessTrustLabelAce(v16, 2ui64, 0i64, SeProcTrustWinTcbSid, 0x14u, AccessMask);
      v17 = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1683187027i64);
      v18 = v17;
      if( v17 )
      {
        RtlCreateSecurityDescriptor(v17, 1ui64);
        RtlSetDaclSecurityDescriptor(v18, 1u, v12, 0);
        RtlSetSaclSecurityDescriptor(v18, 1u, v16, 0);
        RtlSetOwnerSecurityDescriptor(v18, SeAliasAdminsSid, 0);
        RtlSetGroupSecurityDescriptor(v18, SeAliasAdminsSid, 0);
        ExpirationTime.Length = 48;
        memset(&ExpirationTime.RootDirectory, 0, 20);
        ExpirationTime.SecurityQualityOfService = 0i64;
        LODWORD(DefaultDacl) = 31;
        LODWORD(PrimaryGroup) = v8;
        LODWORD(Privileges) = 4;
        ExpirationTime.SecurityDescriptor = v18;
        SepCreateToken(
          &TokenHandle,
          v19,
          v20,
          &ExpirationTime,
          (_TOKEN_TYPE)AceType,
          (_SECURITY_IMPERSONATION_LEVEL)AccessMask,
          (_SID_AND_ATTRIBUTES *)&SeSystemAuthenticationId,
          (_LARGE_INTEGER *)&GroupsLength,
          &PrivilegeCount,
          Privileges,
          &Owner,
          PrimaryGroup,
          DefaultDacl,
          &v41,
          TokenSource,
          SystemToken,
          SeSystemDefaultDacl,
          v32,
          v33);
        SeSetMandatoryPolicyToken(TokenHandle, &MandatoryPolicy);
        ExFreePoolWithTag(v12, 0);
        ExFreePoolWithTag(v16, 0);
        ExFreePoolWithTag(v18, 0);
        return TokenHandle;
      }
      ExFreePoolWithTag(v12, 0);
      v25 = v16;
    }
    else
    {
      v25 = v12;
    }
    ExFreePoolWithTag(v25, 0);
  }
  return 0i64;
}

Referenced by: