SeExchangePrimaryToken

INT64 __stdcall SeExchangePrimaryToken(_EPROCESS *Process, PVOID NewAccessToken, PVOID *OldAccessToken){
  bool v4; 
  struct _DMA_ADAPTER *v7; 
  unsigned int SessionId; 
  unsigned int v9; 
  _ETHREAD *CurrentThread; 
  unsigned int v11; 
  int v12; 
  UINT64 v13; 
  UINT64 v14; 
  _ETHREAD *v15; 
  INT64 result; 
  struct _DMA_ADAPTER *v17; 
  struct _DMA_ADAPTER *v18; 
  UINT64 v19; 
  VOID *v20; 
  signed __int32 v21[8]; 
  char v22; 
  PADAPTER_OBJECT DmaAdapter; 
  v4 = *((_DWORD *)NewAccessToken + 48) == 1;
  DmaAdapter = 0i64;
  v7 = 0i64;
  v22 = 0;
  if( !v4 )
    return 3221225640i64;
  SessionId = MmGetSessionIdEx((INT64)Process);
  if( SessionId != -1 && !SeTokenDoesNotTrackSessionObject )
  {
    LODWORD(v17) = MmGetSessionObjectById(SessionId);
    v7 = v17;
  }
  v9 = MmGetSessionId((__int64)Process);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v11 = v9;
  --*((_WORD *)CurrentThread + 242);
  ExAcquireResourceExclusiveLite(*((ERESOURCE **)NewAccessToken + 6), 1u);
  _InterlockedOr(v21, 0);
  if( *((_BYTE *)NewAccessToken + 204) )
  {
    _InterlockedOr(v21, 0);
    ExReleaseResourceLite(*((PERESOURCE *)NewAccessToken + 6));
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    if( v7 )
      HalPutDmaAdapter(v7);
    return 3221225771i64;
  }
  else
  {
    *((_BYTE *)NewAccessToken + 204) = 1;
    v12 = SepSetTrustLevelForProcessToken((__int64)NewAccessToken, (__int64)Process, &v22);
    if( v12 < 0 )
    {
      _InterlockedOr(v21, 0);
      ExReleaseResourceLite(*((PERESOURCE *)NewAccessToken + 6));
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      if( !v7 )
        return(unsigned int)v12;
      v18 = v7;
LABEL_21:
      HalPutDmaAdapter(v18);
      return(unsigned int)v12;
    }
    if( (*((_DWORD *)NewAccessToken + 50) & 0x4000) != 0 )
    {
      v19 = *((unsigned int *)NewAccessToken + 30);
      if( (_DWORD)v19 != v11 )
      {
        SepDereferenceLowBoxNumberEntry(v19, *((PVOID *)NewAccessToken + 135));
        *((_QWORD *)NewAccessToken + 135) = 0i64;
        SepSetTokenSessionById((INT64)NewAccessToken, v11, 1, (INT64)v7, &DmaAdapter);
        v20 = (VOID *)*((_QWORD *)NewAccessToken + 98);
        *((_DWORD *)NewAccessToken + 30) = v11;
        v12 = SepSetTokenLowboxNumber((_TOKEN *)NewAccessToken, v20);
        if( v12 < 0 )
        {
          _InterlockedOr(v21, 0);
          ExReleaseResourceLite(*((PERESOURCE *)NewAccessToken + 6));
          KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
          v18 = DmaAdapter;
          if( !DmaAdapter )
            return(unsigned int)v12;
          goto LABEL_21;
        }
      }
    }
    SepSetTokenSessionById((INT64)NewAccessToken, v11, 1, (INT64)v7, &DmaAdapter);
    *((_DWORD *)NewAccessToken + 30) = v11;
    _InterlockedOr(v21, 0);
    ExReleaseResourceLite(*((PERESOURCE *)NewAccessToken + 6));
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    if( DmaAdapter )
      HalPutDmaAdapter(DmaAdapter);
    if( (unsigned __int8)SeAuditingWithTokenForSubcategory(0x85ui64, 0i64) )
      SepAuditAssignPrimaryToken(Process, NewAccessToken);
    ObfReferenceObject(NewAccessToken);
    v14 = ObFastReplaceObject((_EX_FAST_REF *)Process + 151, NewAccessToken, v13);
    if( v14 )
    {
      v15 = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)v15 + 242);
      ExAcquireResourceExclusiveLite(*(ERESOURCE **)(v14 + 48), 1u);
      _InterlockedOr(v21, 0);
      *(_BYTE *)(v14 + 204) = 0;
      _InterlockedOr(v21, 0);
      ExReleaseResourceLite(*(PERESOURCE *)(v14 + 48));
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      result = 0i64;
      *OldAccessToken = (PVOID)v14;
    }
    else
    {
      return 3221225596i64;
    }
  }
  return result;
}

Referenced by: