SepCopyAnonymousTokenAndSetSilo

INT64 __stdcall SepCopyAnonymousTokenAndSetSilo(_EJOB *DestServerSilo, PADAPTER_OBJECT *a2){
  int AnonymousToken; 
  _TOKEN *v5; 
  __int64 CurrentProcess; 
  unsigned int ServerSiloServiceSessionId; 
  UINT64 v9; 
  PACCESS_TOKEN Token; 
  INT64 result[6]; 
  struct DMA_ADAPTER *v12; 
  __int64 v13[28]; 
  Token = 0i64;
  AnonymousToken = SepGetAnonymousToken(0i64, (PADAPTER_OBJECT *)&Token);
  if( AnonymousToken < 0 )
    goto LABEL_8;
  memset((INT64)result, 0i64);
  memset((INT64)v13, 0i64);
  v5 = (_TOKEN *)Token;
  SeCreateAccessState(
    (_ACCESS_STATE *)result,
    (_AUX_ACCESS_DATA *)v13,
    0i64,
    (_GENERIC_MAPPING *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Token - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Token - 48) >> 8)]
                       + 76));
  CurrentProcess = PsGetCurrentProcess();
  ObFastDereferenceObject((INT64 *)(CurrentProcess + 1208), v12);
  ObfReferenceObject(SeAnonymousLogonTokenNoEveryone);
  LODWORD(v9) = 0;
  v12 = (struct DMA_ADAPTER *)SeAnonymousLogonTokenNoEveryone;
  AnonymousToken = ObInsertObjectEx(v5, (ACCESS_STATE *)result, 0i64, 0i64, v9, 0i64, 0i64);
  SeDeleteAccessState((_ACCESS_STATE *)result);
  if( AnonymousToken < 0 )
    goto LABEL_8;
  SepAppendAceToTokenObjectAcl(v5, 8ui64, SeAliasAdminsSid);
  *a2 = (PADAPTER_OBJECT)v5;
  ServerSiloServiceSessionId = PsGetServerSiloServiceSessionId(DestServerSilo);
  if( ServerSiloServiceSessionId != -1 )
    AnonymousToken = SeSetSessionIdToken(v5, ServerSiloServiceSessionId);
  if( AnonymousToken < 0 || (AnonymousToken = SepSetServerSiloToken(*a2, DestServerSilo), AnonymousToken < 0) )
  {
    HalPutDmaAdapter(*a2);
LABEL_8:
    *a2 = 0i64;
  }
  return(unsigned int)AnonymousToken;
}

Referenced by:

NtImpersonateAnonymousToken