CmpBuildAdminInformation

NTSTATUS __stdcall CmpBuildAdminInformation(TOKEN_ACCESS_INFORMATION **AdminInformation){
  INT64 *v1; 
  void *v2; 
  _CHILD_LIST *v3; 
  NTSTATUS v4; 
  _DWORD **v5; 
  unsigned int v6; 
  unsigned int v7; 
  unsigned int v8; 
  unsigned int v9; 
  int v10; 
  __int64 v11; 
  PSID v12; 
  unsigned int v13; 
  unsigned int v14; 
  int v15; 
  unsigned int v16; 
  INT64 v17; 
  INT64 v18; 
  unsigned int *v19; 
  unsigned int v20; 
  __int64 v21; 
  __int64 v22; 
  UINT64 v23; 
  __int64 v25; 
  __int64 v26; 
  _SID_AND_ATTRIBUTES *v27; 
  PVOID TokenInformation; 
  PSID NextTargetSid; 
  PSE_EXPORTS v30; 
  _SID_AND_ATTRIBUTES Src[2]; 
  UINT64 SidAreaSize; 
  NTSTATUS v34; 
  NextTargetSid = 0i64;
  LODWORD(SidAreaSize) = 0;
  TokenInformation = 0i64;
  v2 = (void *)CmpEffectiveTokenForSubject(v1, 0i64);
  v34 = SeQueryInformationToken(v2, TokenAccessInformation, &TokenInformation);
  v4 = v34;
  if( v34 >= 0 )
  {
    v5 = (_DWORD **)TokenInformation;
    v6 = 0;
    v7 = -1;
    v8 = -1;
    v9 = **(_DWORD **)TokenInformation;
    v10 = 16 * v9;
    if( v9 )
    {
      v11 = *(_QWORD *)(*(_QWORD *)TokenInformation + 8i64);
      v30 = SeExports;
      do
      {
        v12 = *(PSID *)v11;
        NextTargetSid = *(PSID *)v11;
        v10 += RtlLengthSid(NextTargetSid);
        if( v7 == -1 && RtlEqualSid(v30->SeAliasAdminsSid, v12) )
        {
          v7 = v6;
        }
        else if( v8 == -1 && (*(_BYTE *)(v11 + 8) & 0x60) == 96 )
        {
          v8 = v6;
        }
        ++v6;
        v11 += 16i64;
      }
      while( v6 < v9 );
      v5 = (_DWORD **)TokenInformation;
    }
    v13 = 0;
    if( v7 == -1 )
    {
      v13 = 1;
      Src[0].Attributes = 7;
      Src[0].Sid = SeExports->SeAliasAdminsSid;
    }
    if( v8 == -1 )
    {
      v25 = v13++;
      Src[v25].Sid = SeExports->SeHighMandatorySid;
      Src[v25].Attributes = 96;
    }
    if( v13 )
    {
      v26 = v13;
      v27 = Src;
      v10 += 16 * v13;
      do
      {
        v10 += RtlLengthSid(v27->Sid);
        ++v27;
        --v26;
      }
      while( v26 );
    }
    v14 = (v10 + 7) & 0xFFFFFFF8;
    v15 = 12 * *v5[2];
    v16 = v15 + v14 + 920 - 12;
    if( !v15 )
      v16 = v14 + 920;
    CmpAllocateTransientPoolWithTag((_HHIVE *)1, v16, 0x20204D43ui64, v3);
    v18 = v17;
    if( v17 )
    {
      memset(v17, 0i64);
      v19 = (unsigned int *)(v18 + 88);
      *(_QWORD *)(v18 + 24) = *((_QWORD *)TokenInformation + 3);
      *(_DWORD *)(v18 + 32) = *((_DWORD *)TokenInformation + 8);
      *(_DWORD *)(v18 + 36) = *((_DWORD *)TokenInformation + 9);
      *(_DWORD *)(v18 + 40) = *((_DWORD *)TokenInformation + 10);
      *(_DWORD *)(v18 + 44) = *((_DWORD *)TokenInformation + 11) & 0xFFFF9FFF | 0x2000;
      v20 = v13 + **(_DWORD **)TokenInformation;
      *(_QWORD *)(v18 + 96) = v18 + 360;
      *(_DWORD *)(v18 + 88) = v20;
      RtlCopySidAndAttributesArray(
        **(unsigned int **)TokenInformation,
        *(SID_AND_ATTRIBUTES **)(*(_QWORD *)TokenInformation + 8i64),
        v14 - 16 * v20,
        (SID_AND_ATTRIBUTES *)(v18 + 360),
        (VOID *)(v18 + 360 + 16 * v20),
        &NextTargetSid,
        &SidAreaSize);
      if( v7 != -1 )
        *(_DWORD *)(*(_QWORD *)(v18 + 96) + 16i64 * v7 + 8) = 7;
      if( v8 != -1 )
        *(_DWORD *)(*(_QWORD *)(v18 + 96) + 16i64 * v8 + 8) = 96;
      if( v13 )
        RtlCopySidAndAttributesArray(
          v13,
          Src,
          (unsigned int)SidAreaSize,
          (SID_AND_ATTRIBUTES *)(*(_QWORD *)(v18 + 96) + 16i64 * **(unsigned int **)TokenInformation),
          NextTargetSid,
          &NextTargetSid,
          &SidAreaSize);
      RtlSidHashInitialize(*(SID_AND_ATTRIBUTES **)(v18 + 96), *v19, (SID_AND_ATTRIBUTES_HASH *)(v18 + 88));
      *(_QWORD *)v18 = v19;
      v21 = *(_QWORD *)(v18 + 96) + v14;
      *(_DWORD *)v21 = 0;
      *(_QWORD *)(v21 + 8) = 0i64;
      *(_QWORD *)(v18 + 8) = v21;
      v21 += 272i64;
      *(_DWORD *)v21 = 0;
      v22 = v21 + 272;
      *(_QWORD *)(v21 + 8) = 0i64;
      *(_QWORD *)(v18 + 64) = v21;
      *(_QWORD *)(v18 + 56) = 0i64;
      v23 = **((unsigned int **)TokenInformation + 2);
      *(_DWORD *)(v21 + 272) = v23;
      RtlCopyLuidAndAttributesArray(
        v23,
        (_LUID_AND_ATTRIBUTES *)(*((_QWORD *)TokenInformation + 2) + 4i64),
        (_LUID_AND_ATTRIBUTES *)(v21 + 276));
      *(_QWORD *)(v18 + 16) = v22;
      v4 = v34;
      *AdminInformation = (TOKEN_ACCESS_INFORMATION *)v18;
    }
    else
    {
      v4 = -1073741670;
    }
  }
  if( TokenInformation )
    ExFreePoolWithTag(TokenInformation, 0);
  return v4;
}

Referenced by: