PspInitializeProcessSecurity

VOID __stdcall PspInitializeProcessSecurity(){
  _EX_FAST_REF *v0; 
  __int64 v1; 
  UINT64 v2; 
  int v3; 
  _DWORD *v4; 
  __int64 v5; 
  int v6; 
  int *v7; 
  _BYTE *v8; 
  __int64 v9; 
  struct DMA_ADAPTER *v10; 
  unsigned int SessionId; 
  int v12; 
  UINT64 v13; 
  int v14; 
  signed __int64 v15; 
  VOID *Object; 
  int v17[4]; 
  __int64 v18; 
  __int64 v19; 
  __int16 v20; 
  char v21; 
  int v22; 
  int v23; 
  int v24; 
  int v25; 
  __int64 v26; 
  int v27; 
  __int64 v28; 
  int v29; 
  __int64 v30; 
  __int64 v31; 
  v4 = (_DWORD *)v31;
  v5 = v1;
  v20 = 0;
  v21 = 0;
  Object = 0i64;
  v6 = v3;
  *(_DWORD *)v31 = 0;
  v7 = v4 + 1;
  v4[1] = 0;
  v8 = (_BYTE *)v2;
  v9 = (__int64)v0;
  v10 = 0i64;
  if( v1 )
  {
    v17[0] = v22;
    v17[1] = v29;
    v17[2] = v23;
    v17[3] = v24;
    v19 = v30;
    v18 = v1;
    SessionId = MmGetSessionId((__int64)v0);
    if( (int)SeSubProcessToken(
                v9,
                (__int64)v8,
                (PADAPTER_OBJECT *)&Object,
                v12 != 0 ? 1 : 3,
                SessionId,
                (__int64)v17,
                v25,
                (_DWORD *)v26,
                v27,
                v28,
                &v20) >= 0 )
    {
      ObInitializeFastReference((_EX_FAST_REF *)(v9 + 1208), Object, v13);
      if( v6 || (_BYTE)v20 )
        *v4 = 1;
      if( HIBYTE(v20) )
      {
        *v7 = 1;
        v14 = 1;
      }
      else
      {
        v14 = *v7;
      }
      if( !v14 && v21 )
      {
        v10 = (struct DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)v5);
        PspIdentityBasedJobBreakaway(v10, Object, v4 + 1);
      }
    }
    if( *v4 || *(int *)(v5 + 2512) < 0 || (*(_DWORD *)(v9 + 2172) & 0x800000) != 0 && !*(_QWORD *)(v5 + 2528) )
      v15 = _InterlockedIncrement64(&PsNextSecurityDomain);
    else
      v15 = *(_QWORD *)(v5 + 2528);
    *(_QWORD *)(v9 + 2528) = v15;
    *(_QWORD *)(v9 + 2536) = v15;
  }
  else
  {
    ObInitializeFastReference(v0 + 151, 0i64, v2);
    SeAssignPrimaryToken(v9, v8);
  }
  if( v10 )
    ObFastDereferenceObject((INT64 *)(v5 + 1208), v10);
}

Referenced by: