SeQueryInformationToken

INT64 __stdcall SeQueryInformationToken(
        PVOID AccessToken,
        _TOKEN_INFORMATION_CLASS TokenInformationClass,
        PVOID *TokenInformation){
  char *v3; 
  unsigned int v7; 
  unsigned int v8; 
  INT64 result; 
  __int32 v10; 
  unsigned __int64 v11; 
  _ETHREAD *CurrentThread; 
  unsigned int v13; 
  SID_AND_ATTRIBUTES *PoolWithTag; 
  _QWORD *p_Sid; 
  _ETHREAD *v16; 
  __int64 v17; 
  BOOL v18; 
  _DWORD *v19; 
  _ETHREAD *v20; 
  unsigned int v21; 
  bool v22; 
  CHAR IsElevatedRid; 
  _DWORD *v24; 
  int v25; 
  _ETHREAD *v26; 
  int v27; 
  _QWORD *v28; 
  BOOL v29; 
  _ETHREAD *v30; 
  __int64 v31; 
  int v32; 
  _ETHREAD *v33; 
  char *v34; 
  unsigned int v35; 
  _QWORD *v36; 
  _QWORD *v37; 
  _ETHREAD *v38; 
  unsigned int v39; 
  unsigned int v40; 
  unsigned int v41; 
  __int64 *v42; 
  __int64 v43; 
  __int64 v44; 
  char *v45; 
  void *v46; 
  BOOL v47; 
  _ETHREAD *v48; 
  unsigned int v49; 
  _QWORD *v50; 
  _ETHREAD *v51; 
  unsigned int TokenAccessInformationBufferSize; 
  _QWORD *v53; 
  _ETHREAD *v54; 
  unsigned int v55; 
  unsigned int v56; 
  unsigned int v57; 
  __int64 v58; 
  __int64 *v59; 
  __int64 v60; 
  char *v61; 
  void *v62; 
  _ETHREAD *v63; 
  unsigned int v64; 
  _QWORD *v65; 
  _DWORD *v66; 
  _ETHREAD *v67; 
  unsigned int v68; 
  unsigned int v69; 
  _TOKEN_PRIVILEGES *v70; 
  _ETHREAD *v71; 
  int v72; 
  unsigned int v73; 
  int v74; 
  unsigned int v75; 
  __int64 *v76; 
  __int64 v77; 
  __int64 v78; 
  unsigned int v79; 
  unsigned int v80; 
  __int64 *v81; 
  __int64 v82; 
  __int64 v83; 
  char *v84; 
  char *v85; 
  char *v86; 
  char *v87; 
  __int64 v88; 
  unsigned int v89; 
  _ETHREAD *v90; 
  __int64 v91; 
  UINT64 v92; 
  char *v93; 
  UINT8 *v94; 
  _OWORD *v95; 
  _DWORD *v96; 
  _ETHREAD *v97; 
  __int64 v98; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v99; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v100; 
  unsigned int v101; 
  VOID *v102; 
  void *v103; 
  int v104; 
  _ETHREAD *v105; 
  unsigned int *v106; 
  unsigned int v107; 
  unsigned int v108; 
  unsigned int v109; 
  __int64 *v110; 
  __int64 v111; 
  __int64 v112; 
  char *v113; 
  _ETHREAD *v114; 
  _ETHREAD *v115; 
  __int64 v116; 
  UINT64 v117; 
  PSID SidArea; 
  PSID *RemainingSidArea; 
  PSID *RemainingSidAreaa; 
  PULONG RemainingSidAreaSize; 
  UINT64 *pRestrictedSidsSALength; 
  UINT64 *pPackageSidLength; 
  UINT64 *pCapabilitySidsLength; 
  UINT64 *pCapabilitySidsSALength; 
  UINT64 *pTrustSidLength; 
  UINT64 *pSecurityAttributesLength; 
  PSID NextTargetSid; 
  UINT64 pPrivilegeCount; 
  UINT64 v130; 
  UINT64 v131; 
  UINT64 v132; 
  __int128 v133; 
  __int128 v134; 
  __int128 v135; 
  PSID Sid[2]; 
  UINT64 v137; 
  SIZE_T NumberOfBytes; 
  UINT64 v139; 
  v3 = 0i64;
  LODWORD(NumberOfBytes) = 0;
  LODWORD(pPrivilegeCount) = 0;
  v133 = 0i64;
  v134 = 0i64;
  v135 = 0i64;
  if( TokenInformationClass == TokenVirtualizationEnabled )
  {
LABEL_2:
    v7 = *((_DWORD *)AccessToken + 50);
    if( TokenInformationClass == TokenVirtualizationAllowed )
    {
      *(_DWORD *)TokenInformation = (*((_DWORD *)AccessToken + 50) & 0x200) != 0;
    }
    else
    {
      switch( TokenInformationClass )
      {
        case TokenVirtualizationEnabled:
          v8 = v7 >> 10;
          break;
        case TokenUIAccess:
          v8 = v7 >> 12;
          break;
        case TokenIsAppContainer:
          v8 = v7 >> 14;
          break;
        case TokenHasRestrictions:
          *(_BYTE *)TokenInformation = (*((_DWORD *)AccessToken + 50) & 0x810) != 0;
          return 0i64;
        default:
          v8 = HIWORD(v7);
          break;
      }
      *(_DWORD *)TokenInformation = v8 & 1;
    }
  }
  else
  {
    v10 = TokenInformationClass - 1;
    v11 = 0x140000000ui64;
    switch( v10 )
    {
      case 0:
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)CurrentThread + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v13 = 4 * *(unsigned __int8 *)(**((_QWORD **)AccessToken + 19) + 1i64) + 24;
        PoolWithTag = (SID_AND_ATTRIBUTES *)ExAllocatePoolWithTag(PagedPool, v13, 0x20206553ui64);
        p_Sid = &PoolWithTag->Sid;
        if( !PoolWithTag )
          goto LABEL_70;
        RtlCopySidAndAttributesArray(
          1ui64,
          *((SID_AND_ATTRIBUTES **)AccessToken + 19),
          v13,
          PoolWithTag,
          &PoolWithTag[1],
          &NextTargetSid,
          (UINT64 *)&NextTargetSid);
        goto LABEL_10;
      case 1:
        v54 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v54 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v55 = *((_DWORD *)AccessToken + 31);
        v56 = 16 * v55 - 8;
        v57 = v56;
        if( v55 > 1 )
        {
          v58 = v55 - 1;
          v59 = (__int64 *)(*((_QWORD *)AccessToken + 19) + 16i64);
          do
          {
            v60 = *v59;
            v59 += 2;
            v56 += 4 * *(unsigned __int8 *)(v60 + 1) + 8;
            v57 = v56;
            --v58;
          }
          while( v58 );
        }
        v61 = (char *)ExAllocatePoolWithTag(PagedPool, v57, 0x20206553ui64);
        v62 = v61;
        if( !v61 )
          goto LABEL_70;
        *(_DWORD *)v61 = *((_DWORD *)AccessToken + 31) - 1;
        RtlCopySidAndAttributesArray(
          (unsigned int)(*((_DWORD *)AccessToken + 31) - 1),
          (SID_AND_ATTRIBUTES *)(*((_QWORD *)AccessToken + 19) + 16i64),
          v56,
          (SID_AND_ATTRIBUTES *)(v61 + 8),
          &v61[16 * *((_DWORD *)AccessToken + 31) - 32 + 24],
          &NextTargetSid,
          (UINT64 *)&NextTargetSid);
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        result = 0i64;
        *TokenInformation = v62;
        return result;
      case 2:
        v67 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v67 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v68 = SepTokenPrivilegeCount((INT64)AccessToken);
        if( v68 <= 1 )
          v69 = 16;
        else
          v69 = 12 * v68 + 4;
        v70 = (_TOKEN_PRIVILEGES *)ExAllocatePoolWithTag(PagedPool, v69, 0x20206553ui64);
        p_Sid = &v70->PrivilegeCount;
        if( !v70 )
          goto LABEL_70;
        SepConvertTokenPrivileges((_TOKEN *)AccessToken, v70);
        goto LABEL_10;
      case 3:
        v63 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v63 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v64 = 4
            * *(unsigned __int8 *)(*(_QWORD *)(*((_QWORD *)AccessToken + 19)
                                             + 16i64 * *((unsigned int *)AccessToken + 36))
                                 + 1i64)
            + 16;
        v65 = ExAllocatePoolWithTag(PagedPool, v64, 0x20206553ui64);
        p_Sid = v65;
        if( !v65 )
          goto LABEL_70;
        *v65 = v65 + 1;
        RtlCopySid(
          v64 - 8,
          v65 + 1,
          *(PSID *)(*((_QWORD *)AccessToken + 19) + 16i64 * *((unsigned int *)AccessToken + 36)));
        goto LABEL_10;
      case 4:
        v48 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v48 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v49 = 4 * *(unsigned __int8 *)(*((_QWORD *)AccessToken + 21) + 1i64) + 16;
        v50 = ExAllocatePoolWithTag(PagedPool, v49, 0x20206553ui64);
        p_Sid = v50;
        if( !v50 )
          goto LABEL_70;
        *v50 = v50 + 1;
        RtlCopySid(v49 - 8, v50 + 1, *((PSID *)AccessToken + 21));
        goto LABEL_10;
      case 5:
        v90 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v90 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v91 = *((_QWORD *)AccessToken + 23);
        v92 = 8i64;
        if( v91 )
          v92 = *(unsigned __int16 *)(v91 + 2) + 8i64;
        v93 = (char *)ExAllocatePoolWithTag(PagedPool, v92, 0x20206553ui64);
        p_Sid = v93;
        if( !v93 )
          goto LABEL_70;
        v94 = (UINT8 *)(v93 + 8);
        if( !*((_QWORD *)AccessToken + 23) )
          goto LABEL_137;
        *(_QWORD *)v93 = v94;
        memmove(v94, *((UINT8 **)AccessToken + 23), *(unsigned __int16 *)(*((_QWORD *)AccessToken + 23) + 2i64));
        goto LABEL_10;
      case 6:
        v95 = ExAllocatePoolWithTag(PagedPool, 0x10ui64, 0x20206553ui64);
        if( !v95 )
          return 3221225626i64;
        *v95 = *(_OWORD *)AccessToken;
        *TokenInformation = v95;
        return 0i64;
      case 7:
        v96 = ExAllocatePoolWithTag(PagedPool, 4ui64, 0x20206553ui64);
        if( !v96 )
          return 3221225626i64;
        *v96 = *((_DWORD *)AccessToken + 48);
        *TokenInformation = v96;
        return 0i64;
      case 8:
        if( *((_DWORD *)AccessToken + 48) != 2 )
          return 3221225475i64;
        v66 = ExAllocatePoolWithTag(PagedPool, 4ui64, 0x20206553ui64);
        if( !v66 )
          return 3221225626i64;
        *v66 = *((_DWORD *)AccessToken + 49);
        *TokenInformation = v66;
        return 0i64;
      case 9:
        v28 = ExAllocatePoolWithTag(PagedPool, 0x38ui64, 0x20206553ui64);
        p_Sid = v28;
        if( !v28 )
          return 3221225626i64;
        *v28 = *((_QWORD *)AccessToken + 2);
        v28[1] = *((_QWORD *)AccessToken + 3);
        *((_DWORD *)v28 + 6) = *((_DWORD *)AccessToken + 48);
        *((_DWORD *)v28 + 7) = *((_DWORD *)AccessToken + 49);
        v28[2] = *((_QWORD *)AccessToken + 5);
        v30 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v30 + 242);
        LOBYTE(v29) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v29);
        *((_DWORD *)p_Sid + 8) = *((_DWORD *)AccessToken + 34);
        v31 = *((_QWORD *)AccessToken + 23);
        v32 = *((_DWORD *)AccessToken + 34) - 4 * *(unsigned __int8 *)(*((_QWORD *)AccessToken + 21) + 1i64) - 8;
        if( v31 )
          v32 -= *(unsigned __int16 *)(v31 + 2);
        *((_DWORD *)p_Sid + 9) = v32;
        *((_DWORD *)p_Sid + 9) = *((_DWORD *)AccessToken + 35);
        *((_DWORD *)p_Sid + 10) = *((_DWORD *)AccessToken + 31) - 1;
        *((_DWORD *)p_Sid + 11) = SepTokenPrivilegeCount((INT64)AccessToken);
        p_Sid[6] = *((_QWORD *)AccessToken + 7);
        goto LABEL_10;
      case 11:
        SeQuerySessionIdToken(AccessToken, (UINT64 *)TokenInformation);
        return 0i64;
      case 12:
        v71 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v71 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v72 = SepTokenPrivilegeCount((INT64)AccessToken);
        v73 = *((_DWORD *)AccessToken + 31);
        LODWORD(v137) = v72;
        v74 = 12 * v72;
        v75 = 16 * v73;
        LODWORD(NumberOfBytes) = 12 * v72;
        LODWORD(v139) = 16 * v73;
        if( v73 )
        {
          v76 = (__int64 *)*((_QWORD *)AccessToken + 19);
          v77 = v73;
          do
          {
            v78 = *v76;
            v76 += 2;
            v75 += (4 * *(unsigned __int8 *)(v78 + 1) + 15) & 0xFFFFFFF8;
            --v77;
          }
          while( v77 );
        }
        v79 = *((_DWORD *)AccessToken + 32);
        LODWORD(pPrivilegeCount) = 16 * v79;
        v80 = 16 * v79;
        if( v79 )
        {
          v81 = (__int64 *)*((_QWORD *)AccessToken + 20);
          v82 = v79;
          do
          {
            v83 = *v81;
            v81 += 2;
            v80 += (4 * *(unsigned __int8 *)(v83 + 1) + 15) & 0xFFFFFFF8;
            --v82;
          }
          while( v82 );
        }
        v84 = (char *)ExAllocatePoolWithTag(PagedPool, v80 + v75 + v74 + 56, 0x20206553ui64);
        v85 = v84;
        if( v84 )
        {
          v86 = v84 + 56;
          *((_QWORD *)v84 + 6) = *((_QWORD *)AccessToken + 3);
          *((_DWORD *)v84 + 1) = v75;
          *(_DWORD *)v84 = *((_DWORD *)AccessToken + 31);
          *((_QWORD *)v84 + 1) = v84 + 56;
          *((_DWORD *)v84 + 5) = v80;
          *((_DWORD *)v84 + 4) = *((_DWORD *)AccessToken + 32);
          if( *((_DWORD *)AccessToken + 32) )
            v3 = &v86[(v75 + 7i64) & 0xFFFFFFFFFFFFFFF8ui64];
          *((_QWORD *)v84 + 3) = v3;
          *((_DWORD *)v84 + 9) = NumberOfBytes;
          *((_DWORD *)v84 + 8) = v137;
          v87 = &v86[v75 + (unsigned __int64)v80];
          v88 = (unsigned int)v139;
          v89 = v75 - v139;
          *((_QWORD *)v85 + 5) = v87;
          RtlCopySidAndAttributesArray(
            *((unsigned int *)AccessToken + 31),
            *((SID_AND_ATTRIBUTES **)AccessToken + 19),
            v89,
            (SID_AND_ATTRIBUTES *)(v85 + 56),
            &v85[v88 + 56],
            &NextTargetSid,
            (UINT64 *)&NextTargetSid);
          if( *((_DWORD *)v85 + 4) )
            RtlCopySidAndAttributesArray(
              *((unsigned int *)AccessToken + 32),
              *((SID_AND_ATTRIBUTES **)AccessToken + 20),
              v80 - (unsigned int)pPrivilegeCount,
              *((SID_AND_ATTRIBUTES **)v85 + 3),
              (VOID *)(*((_QWORD *)v85 + 3) + (unsigned int)pPrivilegeCount),
              &NextTargetSid,
              (UINT64 *)&NextTargetSid);
          SepConvertTokenPrivilegesToLuidAndAttributes((_TOKEN *)AccessToken, *((_LUID_AND_ATTRIBUTES **)v85 + 5));
          ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
          KeLeaveCriticalRegion();
          result = 0i64;
          *TokenInformation = v85;
        }
        else
        {
          ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
          KeLeaveCriticalRegion();
          return 3221225626i64;
        }
        return result;
      case 17:
        v24 = ExAllocatePoolWithTag(PagedPool, 4ui64, 0x20206553ui64);
        if( !v24 )
          return 3221225626i64;
        v25 = *(_DWORD *)(*((_QWORD *)AccessToken + 27) + 32i64);
        if( (v25 & 4) != 0 )
        {
          *v24 = 3;
        }
        else
        {
          LOBYTE(v3) = (v25 & 2) != 0;
          *v24 = (_DWORD)v3 + 1;
        }
        *TokenInformation = v24;
        return 0i64;
      case 19:
        v19 = ExAllocatePoolWithTag(PagedPool, 4ui64, 0x20206553ui64);
        if( !v19 )
          return 3221225626i64;
        v20 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v20 + 242);
        LOBYTE(v18) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v18);
        v21 = *((_DWORD *)AccessToken + 31);
        v22 = (*((_QWORD *)AccessToken + 8) & 0x1120160684i64) != 0;
        if( v21 )
        {
          do
          {
            if( v22 )
              break;
            IsElevatedRid = RtlIsElevatedRid(*((_QWORD *)AccessToken + 19) + 16i64 * (unsigned int)v3);
            LODWORD(v3) = (_DWORD)v3 + 1;
            v22 = IsElevatedRid;
          }
          while( (unsigned int)v3 < v21 );
        }
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *v19 = v22;
        *TokenInformation = v19;
        return 0i64;
      case 20:
      case 22:
      case 25:
      case 28:
      case 41:
        goto LABEL_2;
      case 21:
        v51 = (_ETHREAD *)KeGetCurrentThread();
        v132 = 0i64;
        HIDWORD(v131) = 0;
        --*((_WORD *)v51 + 242);
        LODWORD(v131) = 0;
        v130 = 0i64;
        HIDWORD(pPrivilegeCount) = 0;
        LODWORD(v139) = 0;
        LODWORD(v137) = 0;
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        TokenAccessInformationBufferSize = SepGetTokenAccessInformationBufferSize(
                                             (_TOKEN *)AccessToken,
                                             0,
                                             0i64,
                                             &pPrivilegeCount,
                                             (UINT64 *)((char *)&v132 + 4),
                                             &v132,
                                             (UINT64 *)((char *)&v131 + 4),
                                             &v131,
                                             (UINT64 *)((char *)&v130 + 4),
                                             &v130,
                                             (UINT64 *)((char *)&pPrivilegeCount + 4),
                                             &v139,
                                             &v137);
        v53 = ExAllocatePoolWithTag(PagedPool, TokenAccessInformationBufferSize, 0x20206553ui64);
        p_Sid = v53;
        if( !v53 )
          goto LABEL_70;
        LODWORD(pSecurityAttributesLength) = v137;
        LODWORD(pTrustSidLength) = v139;
        LODWORD(pCapabilitySidsSALength) = HIDWORD(pPrivilegeCount);
        LODWORD(pPackageSidLength) = HIDWORD(v130);
        LODWORD(pCapabilitySidsLength) = v130;
        LODWORD(RemainingSidAreaSize) = HIDWORD(v131);
        LODWORD(pRestrictedSidsSALength) = v131;
        LODWORD(SidArea) = HIDWORD(v132);
        LODWORD(RemainingSidAreaa) = v132;
        SepCopyTokenAccessInformation(
          (INT64)AccessToken,
          (INT64)v53,
          TokenAccessInformationBufferSize,
          (unsigned int)pPrivilegeCount,
          (UINT64)SidArea,
          (UINT64)RemainingSidAreaa,
          (UINT64)RemainingSidAreaSize,
          (UINT64)pRestrictedSidsSALength,
          (INT64)pPackageSidLength,
          (UINT64)pCapabilitySidsLength,
          (UINT64)pCapabilitySidsSALength,
          (INT64)pTrustSidLength,
          (UINT64)pSecurityAttributesLength,
          0,
          0i64);
        goto LABEL_10;
      case 24:
        v26 = (_ETHREAD *)KeGetCurrentThread();
        *(_OWORD *)Sid = 0i64;
        --*((_WORD *)v26 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        SepCopyTokenIntegrity((INT64)AccessToken);
        v27 = *RtlSubAuthorityCountSid(Sid[0]);
        if( (_BYTE)v27 )
          LODWORD(v3) = *RtlSubAuthoritySid(Sid[0], (unsigned int)(v27 - 1));
        *(_DWORD *)TokenInformation = (_DWORD)v3;
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        return 0i64;
      case 29:
        v38 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v38 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v39 = *((_DWORD *)AccessToken + 200);
        v40 = 16 * v39 + 24;
        v41 = v40;
        if( v39 )
        {
          v42 = (__int64 *)*((_QWORD *)AccessToken + 99);
          v43 = v39;
          do
          {
            v44 = *v42;
            v42 += 2;
            v40 += 4 * *(unsigned __int8 *)(v44 + 1) + 8;
            v41 = v40;
            --v43;
          }
          while( v43 );
        }
        v45 = (char *)ExAllocatePoolWithTag(PagedPool, v41, 0x20206553ui64);
        v37 = v45;
        if( !v45 )
          goto LABEL_70;
        *(_DWORD *)v45 = *((_DWORD *)AccessToken + 200);
        RtlCopySidAndAttributesArray(
          *((unsigned int *)AccessToken + 200),
          *((SID_AND_ATTRIBUTES **)AccessToken + 99),
          v40,
          (SID_AND_ATTRIBUTES *)(v45 + 8),
          &v45[16 * *((_DWORD *)AccessToken + 200) + 24],
          &NextTargetSid,
          (UINT64 *)&NextTargetSid);
        goto LABEL_39;
      case 30:
        v33 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v33 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v34 = (char *)*((_QWORD *)AccessToken + 98);
        if( v34 )
          v35 = 4 * (unsigned __int8)v34[1] + 16;
        else
          v35 = 8;
        v36 = ExAllocatePoolWithTag(PagedPool, v35, 0x20206553ui64);
        v37 = v36;
        if( !v36 )
          goto LABEL_70;
        if( !v34 )
          goto LABEL_38;
        v46 = (void *)*((_QWORD *)AccessToken + 98);
        goto LABEL_51;
      case 31:
        v16 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v16 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v17 = *((_QWORD *)AccessToken + 135);
        if( v17 )
          LODWORD(v3) = *(_DWORD *)(v17 + 40);
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *(_DWORD *)TokenInformation = (_DWORD)v3;
        return 0i64;
      case 32:
      case 33:
        *TokenInformation = 0i64;
        v97 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v97 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v98 = *((_QWORD *)AccessToken + 137);
        if( v98
          && ((v99 = *(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)(v98 + 576)) != 0i64
           || TokenInformationClass != TokenUserClaimAttributes)
          && ((v100 = *(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)(v98 + 584)) != 0i64
           || TokenInformationClass != TokenDeviceClaimAttributes) )
        {
          if( TokenInformationClass == TokenUserClaimAttributes )
            v100 = v99;
          AuthzBasepQueryClaimAttributesToken(v100, 0i64, 0i64, &NumberOfBytes);
          v101 = NumberOfBytes;
        }
        else
        {
          DWORD2(v134) = 0;
          *(_QWORD *)&v134 = (char *)&v133 + 8;
          v100 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)&v133;
          v101 = 16;
          *((_QWORD *)&v133 + 1) = (char *)&v133 + 8;
          *((_QWORD *)&v135 + 1) = &v135;
          *(_QWORD *)&v135 = &v135;
        }
        v102 = ExAllocatePoolWithTag(PagedPool, v101, 0x20206553ui64);
        v103 = v102;
        if( !v102 )
          goto LABEL_70;
        v104 = AuthzBasepQueryClaimAttributesToken(v100, v102, v101, &NumberOfBytes);
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        if( v104 >= 0 )
          *TokenInformation = v103;
        else
          ExFreePoolWithTag(v103, 0);
        return(unsigned int)v104;
      case 36:
        v105 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v105 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v106 = (unsigned int *)*((_QWORD *)AccessToken + 137);
        if( v106 && (v107 = *v106) != 0 )
        {
          v108 = 16 * v107 + 8;
        }
        else
        {
          v107 = 0;
          v108 = 24;
        }
        v109 = v108;
        if( v107 )
        {
          v110 = (__int64 *)*((_QWORD *)v106 + 1);
          v111 = v107;
          do
          {
            v112 = *v110;
            v110 += 2;
            v108 += 4 * *(unsigned __int8 *)(v112 + 1) + 8;
            v109 = v108;
            --v111;
          }
          while( v111 );
        }
        v113 = (char *)ExAllocatePoolWithTag(PagedPool, v109, 0x20206553ui64);
        if( !v113 )
          goto LABEL_70;
        *(_OWORD *)v113 = 0i64;
        *((_QWORD *)v113 + 2) = 0i64;
        *(_DWORD *)v113 = v107;
        if( v107 )
          RtlCopySidAndAttributesArray(
            **((unsigned int **)AccessToken + 137),
            *(SID_AND_ATTRIBUTES **)(*((_QWORD *)AccessToken + 137) + 8i64),
            v108,
            (SID_AND_ATTRIBUTES *)(v113 + 8),
            &v113[16 * v107 + 8],
            &NextTargetSid,
            (UINT64 *)&NextTargetSid);
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *TokenInformation = v113;
        return 0i64;
      case 40:
        v114 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v114 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v34 = (char *)*((_QWORD *)AccessToken + 138);
        if( v34 )
          v35 = 4 * (unsigned __int8)v34[1] + 16;
        else
          v35 = 8;
        v36 = ExAllocatePoolWithTag(PagedPool, v35, 0x20206553ui64);
        v37 = v36;
        if( !v36 )
          goto LABEL_70;
        if( !v34 )
          goto LABEL_38;
        v46 = (void *)*((_QWORD *)AccessToken + 138);
LABEL_51:
        v34 = (char *)(v36 + 1);
        RtlCopySid(v35 - 8, v36 + 1, v46);
LABEL_38:
        *v37 = v34;
LABEL_39:
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *TokenInformation = v37;
        return 0i64;
      case 43:
        v115 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v115 + 242);
        LOBYTE(v11) = 1;
        ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), v11);
        v116 = *((_QWORD *)AccessToken + 144);
        v117 = 16i64;
        if( v116 )
          v117 = *(unsigned __int16 *)(v116 + 42) + 16i64;
        v93 = (char *)ExAllocatePoolWithTag(PagedPool, v117, 0x20206553ui64);
        p_Sid = v93;
        if( !v93 )
        {
LABEL_70:
          ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
          KeLeaveCriticalRegion();
          return 3221225626i64;
        }
        if( *((_QWORD *)AccessToken + 144) )
        {
          v93[8] = 1;
          *(_QWORD *)v93 = v93 + 16;
          memmove(
            (UINT8 *)v93 + 16,
            *(UINT8 **)(*((_QWORD *)AccessToken + 144) + 48i64),
            *(unsigned __int16 *)(*((_QWORD *)AccessToken + 144) + 42i64));
        }
        else
        {
          v93[8] = 0;
LABEL_137:
          *(_QWORD *)v93 = 0i64;
        }
LABEL_10:
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *TokenInformation = p_Sid;
        break;
      case 45:
        v47 = (*((_DWORD *)AccessToken + 50) & 0x4000) != 0 && !SepCanTokenMatchAllPackageSid((INT64)AccessToken);
        *(_DWORD *)TokenInformation = v47;
        return 0i64;
      case 47:
        LODWORD(RemainingSidArea) = 0;
        wil_details_FeatureReporting_ReportUsageToService(
          &Feature_PPLEnforcement__private_reporting,
          0x126C519ui64,
          0i64,
          0i64,
          (FEATURE_LOGGED_TRAITS *)&Feature_PPLEnforcement_logged_traits,
          (INT64)RemainingSidArea);
        return 3221225475i64;
      default:
        return 3221225475i64;
    }
  }
  return 0i64;
}

Referenced by: