SepCaptureTokenSecurityOperations

NTSTATUS __fastcall SepCaptureTokenSecurityOperations(_DWORD *a1, unsigned int a2, char a3, _QWORD *a4){
  unsigned int v5; 
  unsigned int v7; 
  NTSTATUS result; 
  UINT64 v9; 
  _DWORD *PoolWithTag; 
  __int64 NumberOfBytes[2]; 
  v5 = a2;
  v7 = 0;
  NumberOfBytes[0] = 0i64;
  if( !a3 )
  {
    *a4 = a1;
    return 0;
  }
  if( *a1 == 1 )
  {
    v9 = 4i64;
    NumberOfBytes[0] = 4i64;
    v5 = 1;
  }
  else
  {
    if( !a2 )
      return -1073741811;
    result = RtlULongLongMult(4ui64, a2, (UINT64 *)NumberOfBytes);
    if( result < 0 )
      return result;
    v9 = NumberOfBytes[0];
  }
  if( v9 )
  {
    if( ((unsigned __int8)a1 & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)a1 + v9 > 0x7FFFFFFF0000i64 || (_DWORD *)((char *)a1 + v9) < a1 )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, v9, 0x704F6553ui64);
  NumberOfBytes[0] = (__int64)PoolWithTag;
  if( PoolWithTag )
  {
    while( v7 < v5 )
    {
      PoolWithTag[v7] = a1[v7];
      ++v7;
    }
    *a4 = PoolWithTag;
    return 0;
  }
  return -1073741801;
}

Referenced by: