SepCreateImpersonationTokenDacl

INT64 __stdcall SepCreateImpersonationTokenDacl(_TOKEN *Token, PVOID PrimaryToken, _ACL **Acl){
  unsigned __int8 *Package; 
  unsigned __int8 *v5; 
  unsigned __int8 *v8; 
  UINT32 v9; 
  struct _ACL *PoolWithTag; 
  _ACL *v11; 
  VOID *Sid; 
  Package = 0i64;
  v5 = 0i64;
  Sid = (VOID *)**((_QWORD **)PrimaryToken + 19);
  if( (*((_DWORD *)PrimaryToken + 50) & 0x4000) != 0 )
    v5 = (unsigned __int8 *)*((_QWORD *)PrimaryToken + 98);
  v8 = (unsigned __int8 *)Token->UserAndGroups->Sid;
  if( (Token->TokenFlags & 0x4000) != 0 )
    Package = (unsigned __int8 *)Token->Package;
  v9 = 4
     * (*(unsigned __int8 *)(**((_QWORD **)PrimaryToken + 19) + 1i64)
      + v8[1]
      + *((unsigned __int8 *)SeLocalSystemSid + 1)
      + *((unsigned __int8 *)SeAliasAdminsSid + 1)
      + *(unsigned __int8 *)(*(_QWORD *)&SeRestrictedSid + 1i64))
     + 88;
  if( Package )
    v9 += 4 * Package[1] + 16;
  if( v5 )
  {
    if( Package && RtlEqualSid(v5, Package) )
      v5 = 0i64;
    else
      v9 += 4 * v5[1] + 16;
  }
  PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v9, 0x20206553ui64);
  v11 = PoolWithTag;
  if( PoolWithTag )
  {
    RtlCreateAcl(PoolWithTag, v9, 2u);
    RtlpAddKnownAce(v11, 2ui64, 0i64, 0xF01FFui64, Sid, 0);
    RtlpAddKnownAce(v11, 2ui64, 0i64, 0xF01FFui64, v8, 0);
    RtlpAddKnownAce(v11, 2ui64, 0i64, 0xF01FFui64, SeAliasAdminsSid, 0);
    RtlpAddKnownAce(v11, 2ui64, 0i64, 0xF01FFui64, SeLocalSystemSid, 0);
    if( Package )
      RtlpAddKnownAce(v11, 2ui64, 0i64, 0xF01FFui64, Package, 0);
    if( v5 )
      RtlpAddKnownAce(v11, 2ui64, 0i64, 0xF01FFui64, v5, 0);
    if( *((_QWORD *)PrimaryToken + 20) || Token->RestrictedSids )
      RtlpAddKnownAce(v11, 2ui64, 0i64, 0xF01FFui64, *(VOID **)&SeRestrictedSid, 0);
    *Acl = v11;
    return 0i64;
  }
  else
  {
    *Acl = 0i64;
    return 3221225626i64;
  }
}

Referenced by: