SepLinkLogonSessions

NTSTATUS __stdcall SepLinkLogonSessions(_TOKEN *pAdminToken, VOID *hLUAToken, INT8 PreviousMode){
  _TOKEN *v5; 
  _SEP_LOGON_SESSION_REFERENCES *v6; 
  NTSTATUS v8; 
  int v9; 
  _SEP_LOGON_SESSION_REFERENCES *v10; 
  _SEP_LOGON_SESSION_REFERENCES *LogonSession; 
  _TOKEN *Token; 
  PVOID Object; 
  _SEP_LOGON_SESSION_REFERENCES *ReturnSession; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID DuplicateToken; 

  Token = 0i64;
  DuplicateToken = 0i64;
  v5 = 0i64;
  ReturnSession = 0i64;
  v6 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreateTokenPrivilege, PreviousMode) )
  {
    v9 = -1073741727;
    goto LABEL_20;
  }
  if( pAdminToken->LogonSession->Token )
    goto LABEL_26;
  Object = 0i64;
  v8 = ObReferenceObjectByHandle(hLUAToken, 0x88ui64, (_OBJECT_TYPE *)SeTokenObjectType, PreviousMode, &Object, 0i64);
  v5 = (_TOKEN *)Object;
  v9 = v8;
  if( v8 < 0 )
  {
LABEL_20:
    if( Token )
      ObfDereferenceObjectWithTag(Token, 0x746C6644ui64);
    if( DuplicateToken )
      ObfDereferenceObjectWithTag(DuplicateToken, 0x746C6644ui64);
    if( v6 )
      SepDeReferenceLogonSessionDirect(v6);
    goto LABEL_15;
  }
  v10 = (_SEP_LOGON_SESSION_REFERENCES *)*((_QWORD *)Object + 27);
  if( v10->Token )
    goto LABEL_26;
  LogonSession = pAdminToken->LogonSession;
  if( LogonSession == v10 )
  {
    LogonSession->Flags |= 4u;
    v9 = 0;
    goto LABEL_15;
  }
  if( pAdminToken->TokenType != TokenPrimary || *((_DWORD *)Object + 48) != 1 )
  {
LABEL_26:
    v9 = -1073741811;
    goto LABEL_20;
  }
  ObjectAttributes.Length = 48;
  memset(&ObjectAttributes.RootDirectory, 0, 20);
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v9 = SepDuplicateToken(
         pAdminToken,
         &ObjectAttributes,
         0,
         TokenPrimary,
         SecurityAnonymous,
         0,
         0,
         (_TOKEN **)&DuplicateToken);
  if( v9 < 0 )
    goto LABEL_20;
  v9 = SepDuplicateToken(v5, &ObjectAttributes, 0, TokenPrimary, SecurityAnonymous, 0, 0, &Token);
  if( v9 < 0 )
    goto LABEL_20;
  v9 = SepReferenceLogonSession((_LUID *)DuplicateToken + 3, &ReturnSession);
  if( v9 < 0 )
    goto LABEL_18;
  *(_QWORD *)(*((_QWORD *)DuplicateToken + 27) + 48i64) = DuplicateToken;
  *(_LUID *)(*((_QWORD *)DuplicateToken + 27) + 16i64) = Token->LogonSession->LogonId;
  *(_DWORD *)(*((_QWORD *)DuplicateToken + 27) + 32i64) |= 2u;
  Token->LogonSession->Token = Token;
  Token->LogonSession->BuddyLogonId = *(_LUID *)(*((_QWORD *)DuplicateToken + 27) + 8i64);
  Token->LogonSession->Flags |= 4u;
  if( SeTokenLeakTracking )
  {
    SepRemoveTokenLogonSession(Token);
    SepRemoveTokenLogonSession((_TOKEN *)DuplicateToken);
  }
  v9 = SepStopReferencingLogonSession(Token);
  if( v9 < 0 || (v9 = SepStopReferencingLogonSession((_TOKEN *)DuplicateToken), v9 < 0) )
  {
LABEL_18:
    v6 = ReturnSession;
    goto LABEL_20;
  }
LABEL_15:
  if( v5 )
    ObfDereferenceObjectWithTag(v5, 0x746C6644ui64);
  return v9;
}

Referenced by: