RtlpGetTokenNamedObjectPath

INT64 __stdcall RtlpGetTokenNamedObjectPath(HANDLE TokenHandle, PSID Sid){
  char v2; 
  _UNICODE_STRING *v3; 
  char v4; 
  _UNICODE_STRING *v7; 
  PSID v8; 
  PSID v9; 
  int v10; 
  int v11; 
  int v12; 
  signed int AppContainerSidType; 
  __int64 v15; 
  bool v16; 
  int v17; 
  WCHAR v18; 
  signed int v19; 
  wchar_t *v20; 
  wchar_t v21; 
  wchar_t *v22; 
  wchar_t *v23; 
  wchar_t v24; 
  WCHAR v25; 
  int v26; 
  size_t v27; 
  int v28; 
  UINT64 v29; 
  wchar_t *StringRoutine; 
  wchar_t *v31; 
  char v32; 
  PSID ParentAppContainerSid; 
  int TokenInformation; 
  UINT64 ReturnLength; 
  int v36; 
  int v37; 
  int v38; 
  int v39; 
  size_t pcbLength; 
  struct _UNICODE_STRING DestinationString; 
  int v42; 
  UNICODE_STRING Source; 
  struct _UNICODE_STRING UnicodeString; 
  UNICODE_STRING v45; 
  PSID Sida[12]; 
  INT64 result[10]; 
  wchar_t psz[264]; 
  PCWSTR SourceString; 
  char v50; 
  wchar_t pszDest[264]; 
  v4 = v2;
  v37 = 0;
  ParentAppContainerSid = 0i64;
  v7 = v3;
  v8 = 0i64;
  v9 = 0i64;
  memset((INT64)result, 0i64);
  LODWORD(ReturnLength) = 0;
  v36 = 0;
  memset((INT64)psz, 0i64);
  memset((INT64)pszDest, 0i64);
  memset((INT64)Sida, 0i64);
  *(_QWORD *)&Source.Length = 262146i64;
  Source.Buffer = (wchar_t *)L"\\";
  v45 = 0i64;
  if( !v7 || !TokenHandle )
    return 3221225485i64;
  TokenInformation = 0;
  HIDWORD(ReturnLength) = 0;
  v38 = v4 & 2;
  v32 = 1;
  v10 = v4 & 8;
  v11 = v4 & 1;
  v12 = v4 & 4;
  LODWORD(pcbLength) = v11;
  v39 = v10;
  v42 = v12;
  *v7 = 0i64;
  DestinationString = 0i64;
  UnicodeString = 0i64;
  if( Sid )
  {
    v8 = Sid;
    TokenInformation = 1;
    goto LABEL_17;
  }
  AppContainerSidType = NtQueryInformationToken(
                          TokenHandle,
                          TokenIsAppContainer,
                          &TokenInformation,
                          4ui64,
                          &ReturnLength);
  if( AppContainerSidType >= 0 )
  {
    if( !TokenInformation )
      goto LABEL_17;
    AppContainerSidType = NtQueryInformationToken(TokenHandle, TokenAppContainerSid, result, 0x50ui64, &ReturnLength);
    if( AppContainerSidType >= 0 )
    {
      v8 = (PSID)result[0];
      if( !result[0] )
      {
        AppContainerSidType = -1073741823;
        goto LABEL_10;
      }
LABEL_17:
      AppContainerSidType = NtQueryInformationToken(
                              TokenHandle,
                              TokenIsRestricted|TokenGroups,
                              (char *)&ReturnLength + 4,
                              4ui64,
                              &ReturnLength);
      if( AppContainerSidType < 0 )
        goto LABEL_10;
      if( HIDWORD(ReturnLength) )
      {
        AppContainerSidType = NtQueryInformationToken(TokenHandle, TokenUser, Sida, 0x58ui64, &ReturnLength);
        if( AppContainerSidType < 0 )
          goto LABEL_10;
        AppContainerSidType = RtlConvertSidToUnicodeString(&UnicodeString, Sida[0], 1u);
        if( AppContainerSidType < 0 )
          goto LABEL_10;
      }
      AppContainerSidType = NtQueryInformationToken(TokenHandle, TokenSessionId, &v36, 4ui64, &ReturnLength);
      if( AppContainerSidType < 0 )
        goto LABEL_10;
      v15 = 260i64;
      if( TokenInformation )
      {
        AppContainerSidType = RtlGetAppContainerSidType(v8, &v37);
        if( AppContainerSidType < 0 )
          goto LABEL_35;
        if( v37 == 2 )
        {
          AppContainerSidType = RtlConvertSidToUnicodeString(&DestinationString, v8, 1u);
          if( AppContainerSidType >= 0 )
            goto LABEL_26;
          goto LABEL_35;
        }
        AppContainerSidType = RtlGetAppContainerParent(v8, &ParentAppContainerSid);
        if( AppContainerSidType < 0
          || (AppContainerSidType = RtlConvertSidToUnicodeString(&DestinationString, ParentAppContainerSid, 1u),
              AppContainerSidType < 0)
          || (RtlSubAuthoritySid(v8, 0xBui64),
              RtlSubAuthoritySid(v8, 0xAui64),
              RtlSubAuthoritySid(v8, 9ui64),
              RtlSubAuthoritySid(v8, 8ui64),
              RtlStringCchPrintfW(pszDest, 0x104ui64, (WCHAR *)L"%s\\%u-%u-%u-%u"),
              AppContainerSidType = v17,
              v17 < 0) )
        {
LABEL_35:
          v9 = ParentAppContainerSid;
          goto LABEL_10;
        }
        RtlFreeAnsiString(&DestinationString);
        RtlInitUnicodeString(&DestinationString, pszDest, v18);
        v12 = v42;
        LOBYTE(v11) = pcbLength;
        v32 = 0;
      }
LABEL_26:
      AppContainerSidType = NtQueryInformationToken(
                              TokenHandle,
                              TokenIsRestricted|TokenOwner,
                              &SourceString,
                              0x120ui64,
                              &ReturnLength);
      if( AppContainerSidType < 0 )
      {
LABEL_70:
        v9 = ParentAppContainerSid;
        goto LABEL_10;
      }
      v16 = !HIDWORD(ReturnLength) && !TokenInformation && v36 == (unsigned int)RtlGetCurrentServiceSessionId();
      if( (_BYTE)v11 )
      {
        if( !v12 )
        {
          RtlStringCchPrintfW(psz, 0x104ui64, (WCHAR *)L"Global\\Session\\%ld%s");
          goto LABEL_49;
        }
        v23 = psz;
        do
        {
          if( v15 == -2147483386 )
            break;
          v24 = *(wchar_t *)((char *)v23 + (char *)L"AppContainerNamedObjects" - (char *)psz);
          if( !v24 )
            break;
          *v23++ = v24;
          --v15;
        }
        while( v15 );
        v22 = v23 - 1;
        if( v15 )
          v22 = v23;
      }
      else
      {
        if( !v16 )
        {
          RtlStringCchPrintfW(psz, 0x104ui64, (WCHAR *)L"%s\\%ld\\%s");
LABEL_49:
          AppContainerSidType = v19;
LABEL_57:
          if( AppContainerSidType >= 0 )
          {
            pcbLength = 0i64;
            AppContainerSidType = RtlStringCbLengthW(psz, 0x208ui64, &pcbLength);
            if( AppContainerSidType >= 0 )
            {
              v26 = v38;
              if( !HIDWORD(ReturnLength) || v38 )
                v27 = pcbLength;
              else
                v27 = UnicodeString.Length + pcbLength + 2;
              if( TokenInformation )
                v27 += DestinationString.Length + 2i64;
              v28 = v39;
              if( v50 && !v39 )
              {
                RtlInitUnicodeString(&v45, SourceString, v25);
                v27 += v45.Length + 2i64;
              }
              v29 = v27 + 2;
              StringRoutine = (wchar_t *)ExpAllocateStringRoutine(v29);
              v31 = StringRoutine;
              if( StringRoutine )
              {
                memset((INT64)StringRoutine, 0i64);
                *v7 = 0i64;
                v7->MaximumLength = v29;
                v7->Buffer = v31;
                AppContainerSidType = RtlAppendUnicodeToString(v7, psz);
                if( AppContainerSidType >= 0 )
                {
                  if( !HIDWORD(ReturnLength)
                    || v26
                    || (AppContainerSidType = RtlAppendUnicodeStringToString(v7, &Source), AppContainerSidType >= 0)
                    && (AppContainerSidType = RtlAppendUnicodeStringToString(v7, &UnicodeString),
                        AppContainerSidType >= 0) )
                  {
                    if( !TokenInformation
                      || (AppContainerSidType = RtlAppendUnicodeStringToString(v7, &Source), AppContainerSidType >= 0)
                      && (AppContainerSidType = RtlAppendUnicodeStringToString(v7, &DestinationString),
                          AppContainerSidType >= 0) )
                    {
                      if( v50 )
                      {
                        if( !v28 )
                        {
                          AppContainerSidType = RtlAppendUnicodeStringToString(v7, &Source);
                          if( AppContainerSidType >= 0 )
                            AppContainerSidType = RtlAppendUnicodeStringToString(v7, &v45);
                        }
                      }
                    }
                  }
                }
              }
              else
              {
                AppContainerSidType = -1073741670;
              }
            }
          }
          goto LABEL_70;
        }
        v20 = psz;
        do
        {
          if( v15 == -2147483386 )
            break;
          v21 = *(wchar_t *)((char *)v20 + (char *)L"\\BaseNamedObjects" - (char *)psz);
          if( !v21 )
            break;
          *v20++ = v21;
          --v15;
        }
        while( v15 );
        v22 = v20 - 1;
        if( v15 )
          v22 = v20;
      }
      *v22 = 0;
      AppContainerSidType = v15 == 0 ? 0x80000005 : 0;
      goto LABEL_57;
    }
  }
LABEL_10:
  RtlFreeAnsiString(&UnicodeString);
  if( AppContainerSidType < 0 )
    RtlFreeAnsiString(v7);
  if( v32 )
    RtlFreeAnsiString(&DestinationString);
  if( v9 )
    ExFreePoolWithTag(v9, 0);
  return(unsigned int)AppContainerSidType;
}

Referenced by: