SepCreateClientSecurityEx

NTSTATUS __fastcall SepCreateClientSecurityEx(
        VOID *Token,
        __int64 a2,
        char a3,
        int a4,
        char a5,
        int a6,
        char a7,
        __int64 a8,
        char a9,
        VOID **a10,
        __int64 a11){
  char v12; 
  _QWORD *SourceName; 
  int v15; 
  __int64 v16; 
  char v17; 
  NTSTATUS result; 
  bool v19; 
  UINT8 v20; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  _ADAPTER_OBJECT *v23; 
  _ADAPTER_OBJECT *v24; 
  _TOKEN *v25; 
  NTSTATUS AnonymousToken; 
  __int64 v27; 
  UINT8 v28; 
  _EJOB *CurrentServerSilo; 
  VOID **DuplicateToken; 
  VOID *v31; 
  _EJOB *ServerSilo; 
  _TOKEN *DesiredAnonymousLowboxToken; 

  v12 = 0;
  v31 = 0i64;
  DesiredAnonymousLowboxToken = 0i64;
  SourceName = Token;
  if( *(_BYTE *)(a2 + 8) >= 2u )
    return -1073741811;
  v15 = *(_DWORD *)(a2 + 4);
  if( (unsigned int)v15 > 3 )
    return -1073741659;
  if( a4 == 2 )
  {
    if( v15 > a6 )
    {
      if( !a7 )
        return -1073741659;
      v12 = 1;
    }
    if( (unsigned int)a6 > 1 && (!a3 || a6 == 3) )
    {
      v19 = a5 || *(_BYTE *)(a2 + 9);
      v16 = a11;
      *(_BYTE *)(a11 + 25) = v19;
      if( !v12 )
        goto LABEL_5;
LABEL_28:
      if( (*((_DWORD *)Token + 50) & 0x4000) == 0 )
      {
        if( a8 )
        {
          CurrentThread = (_ETHREAD *)KeGetCurrentThread();
          if( (_ETHREAD *)a8 == CurrentThread )
            Process = CurrentThread->Tcb.ApcState.Process;
          else
            Process = *(_EPROCESS **)(a8 + 544);
          v23 = (_ADAPTER_OBJECT *)PsReferencePrimaryToken(Process);
          v24 = v23;
          if( ((__int64)v23->WaitQueueEntry[2].Blink & 0x4000) != 0 )
            v25 = (_TOKEN *)v23;
          else
            v25 = 0i64;
          AnonymousToken = SepGetAnonymousToken(v25, &DesiredAnonymousLowboxToken);
          HalPutDmaAdapter(v24);
LABEL_35:
          if( AnonymousToken < 0 )
            return AnonymousToken;
          SourceName = DesiredAnonymousLowboxToken->TokenSource.SourceName;
          LODWORD(DuplicateToken) = 0;
          result = ObInsertObjectEx(DesiredAnonymousLowboxToken, 0i64, 0i64, 0i64, (UINT64)DuplicateToken, 0i64, 0i64);
          if( result >= 0 )
          {
            *(_QWORD *)v16 = 12i64;
            *(_BYTE *)(v16 + 8) = 0;
            v17 = *(_BYTE *)(a2 + 9);
            *(_BYTE *)(v16 + 24) = 0;
            goto LABEL_9;
          }
          return result;
        }
        Token = 0i64;
      }
      AnonymousToken = SepGetAnonymousToken((_TOKEN *)Token, &DesiredAnonymousLowboxToken);
      goto LABEL_35;
    }
    if( a7 )
    {
      v16 = a11;
      goto LABEL_28;
    }
    return -1073741659;
  }
  v16 = a11;
  *(_BYTE *)(a11 + 25) = *(_BYTE *)(a2 + 9);
LABEL_5:
  if( *(_BYTE *)(a2 + 8) )
  {
    *(_BYTE *)(v16 + 24) = 1;
    if( a3 )
      SeGetTokenControlInformation(Token, (_TOKEN_CONTROL *)(v16 + 28));
LABEL_8:
    *(_DWORD *)v16 = 12;
    *(_DWORD *)(v16 + 4) = *(_DWORD *)(a2 + 4);
    *(_BYTE *)(v16 + 8) = *(_BYTE *)(a2 + 8);
    v17 = *(_BYTE *)(a2 + 9);
LABEL_9:
    *(_QWORD *)(v16 + 16) = SourceName;
    *(_BYTE *)(v16 + 9) = v17;
    result = 0;
    *(_BYTE *)(v16 + 26) = a3;
    return result;
  }
  *(_BYTE *)(v16 + 24) = 0;
  if( PsIsCurrentThreadInServerSilo() )
  {
    v27 = SourceName[3];
    ServerSilo = 0i64;
    if( SeQueryServerSiloToken(SourceName, (PFLUSH_ADAPTER_BUFFERS_EX *)&ServerSilo) >= 0
      && PsIsHostSilo(ServerSilo)
      && v27 == 999 )
    {
      CurrentServerSilo = PsGetCurrentServerSilo();
      result = SepCopyClientTokenAndSetSilo(
                 SourceName,
                 *(_SECURITY_IMPERSONATION_LEVEL *)(a2 + 4),
                 CurrentServerSilo,
                 &v31);
    }
    else
    {
      result = SeCopyClientToken(SourceName, *(_SECURITY_IMPERSONATION_LEVEL *)(a2 + 4), v28, 0i64, 0i64);
    }
  }
  else
  {
    result = SeCopyClientToken(
               SourceName,
               *(_SECURITY_IMPERSONATION_LEVEL *)(a2 + 4),
               v20,
               (VOID *)(unsigned __int8)a9,
               a10);
  }
  SourceName = v31;
  if( result >= 0 )
    goto LABEL_8;
  return result;
}

Referenced by: