RtlpQueryLowBoxId

INT64 __fastcall RtlpQueryLowBoxId(){
  struct _DMA_ADAPTER *v0; 
  _TOKEN_TYPE v1; 
  struct _DMA_ADAPTER *v2; 
  struct _DMA_ADAPTER *v4; 
  PVOID TokenInformation; 
  UINT8 EffectiveOnly; 
  _TOKEN_TYPE TokenType; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; 
  PVOID v9; 
  LODWORD(v9) = 0;
  TokenType = 0;
  ImpersonationLevel = SecurityAnonymous;
  EffectiveOnly = 0;
  v0 = (struct _DMA_ADAPTER *)PsReferenceEffectiveToken(
                                (_ETHREAD *)KeGetCurrentThread(),
                                &TokenType,
                                &EffectiveOnly,
                                &ImpersonationLevel,
                                0i64);
  v1 = TokenType;
  v2 = v0;
  if( TokenType == TokenImpersonation && ImpersonationLevel < SecurityImpersonation )
  {
    v4 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken(*((PEPROCESS *)KeGetCurrentThread() + 23));
    SeQueryInformationToken(v4, TokenIsAppContainer, &v9);
    if( (_DWORD)v9 == 1 )
    {
      if( v2 )
        HalPutDmaAdapter(v2);
      v2 = v4;
      v1 = TokenPrimary;
    }
    else
    {
      HalPutDmaAdapter(v4);
      v1 = TokenType;
    }
  }
  LODWORD(TokenInformation) = 0;
  SeQueryInformationToken(v2, TokenAppContainerNumber, &TokenInformation);
  if( v1 == TokenPrimary || v2 )
    HalPutDmaAdapter(v2);
  return(unsigned int)TokenInformation;
}

Referenced by: