NtImpersonateAnonymousToken

INT64 __fastcall NtImpersonateAnonymousToken(VOID *ThreadHandle){
  KPROCESSOR_MODE v1; 
  INT64 result; 
  UINT64 *v3; 
  _DWORD *PrimaryToken; 
  _DWORD *ClientToken; 
  int AnonymousToken; 
  _TOKEN *v7; 
  _EJOB *CurrentServerSilo; 
  __int64 v9; 
  struct _DMA_ADAPTER *v10; 
  struct _DMA_ADAPTER *v11; 
  PADAPTER_OBJECT DmaAdapter; 
  PACCESS_TOKEN v13; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID Object; 
  PVOID Token; 
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DmaAdapter = 0i64;
  Token = 0i64;
  v1 = *((_BYTE *)KeGetCurrentThread() + 562);
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v13 = 0i64;
  Object = 0i64;
  LODWORD(result) = ObReferenceObjectByHandle(ThreadHandle, 0x100u, (POBJECT_TYPE)PsThreadType, v1, &Object, 0i64);
  if( (int)result < 0 )
    return result;
  SeCaptureSubjectContext(&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  ClientToken = SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    ClientToken = SubjectContext.ClientToken;
  SepRegQueryDwordValue(v3);
  if( ClientToken[48] == 1 || (PrimaryToken[50] & 0x4000) == 0 || (int)ClientToken[49] >= 2 )
  {
    if( (ClientToken[50] & 0x4000) != 0 )
    {
      AnonymousToken = SepGetAnonymousToken((INT64)ClientToken, (PADAPTER_OBJECT *)&v13);
      if( AnonymousToken >= 0 )
      {
        AnonymousToken = PsImpersonateClient((_ETHREAD *)Object, v13, 1u, 0, SecurityImpersonation);
        HalPutDmaAdapter((PADAPTER_OBJECT)v13);
      }
      goto LABEL_24;
    }
    SepRegQueryDwordValue((UINT64 *)0x4000);
    v7 = (_TOKEN *)SeAnonymousLogonTokenNoEveryone;
    if( PsIsCurrentThreadInServerSilo() )
    {
      CurrentServerSilo = PsGetCurrentServerSilo();
      AnonymousToken = SepCopyAnonymousTokenAndSetSilo(CurrentServerSilo, (PADAPTER_OBJECT *)&Token);
      if( AnonymousToken < 0 )
        goto LABEL_24;
      v7 = (_TOKEN *)Token;
    }
    else if( (ClientToken[50] & 0x380000) != 0 )
    {
      ObjectAttributes.Length = 48;
      memset(&ObjectAttributes.RootDirectory, 0, 20);
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      AnonymousToken = SepDuplicateToken(
                         v7,
                         &ObjectAttributes,
                         1u,
                         TokenImpersonation,
                         SecurityImpersonation,
                         0,
                         1u,
                         (_TOKEN **)&DmaAdapter);
      if( AnonymousToken < 0 )
        goto LABEL_24;
      LODWORD(DmaAdapter[12].DmaOperations) |= ClientToken[50] & 0x380000;
      v7 = (_TOKEN *)DmaAdapter;
    }
    AnonymousToken = ObReferenceObjectByPointer(
                       v7,
                       4u,
                       (POBJECT_TYPE)SeTokenObjectType,
                       *((_BYTE *)KeGetCurrentThread() + 562));
    if( AnonymousToken >= 0 )
    {
      HalPutDmaAdapter((PADAPTER_OBJECT)v7);
      v9 = *((_QWORD *)KeGetCurrentThread() + 23);
      v10 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)v9);
      v11 = v10;
      if( v10 )
      {
        if( !SeTokenIsRestricted(v10) || SeTokenIsWriteRestricted(v11) )
        {
          ObFastDereferenceObject((INT64 *)(v9 + 1208), v11);
          AnonymousToken = PsImpersonateClient((_ETHREAD *)Object, v7, Token == 0i64, 0, SecurityImpersonation);
        }
        else
        {
          HalPutDmaAdapter(v11);
          AnonymousToken = -1073741790;
        }
      }
      else
      {
        AnonymousToken = -1073741823;
      }
    }
    goto LABEL_24;
  }
  AnonymousToken = -1073741659;
LABEL_24:
  SeReleaseSubjectContext(&SubjectContext);
  if( Object )
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  if( Token )
    HalPutDmaAdapter((PADAPTER_OBJECT)Token);
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  return(unsigned int)AnonymousToken;
}

Referenced by: