SeMakeAnonymousLogonToken

VOID *__fastcall SeMakeAnonymousLogonToken(){
  char *v0; 
  unsigned int v1; 
  _LARGE_INTEGER v2; 
  unsigned int v3; 
  VOID *PrimaryGroup; 
  unsigned int v5; 
  UINT32 v6; 
  struct _ACL *PoolWithTag; 
  _ACL *DefaultDacl; 
  void *v9; 
  void *v10; 
  CHAR v11; 
  UINT64 v12; 
  __int64 *v14; 
  __int64 v15; 
  __int64 v16; 
  int v17[12]; 
  ULONG v18[2]; 
  UINT64 GroupsLength; 
  UINT64 PrivilegeCount; 
  _TOKEN_SOURCE *v21; 
  UINT8 v22; 
  _TOKEN_MANDATORY_POLICY MandatoryPolicy; 
  _LARGE_INTEGER a2; 
  _LARGE_INTEGER ExpirationTime; 
  VOID *TokenHandle; 
  _SID_AND_ATTRIBUTES User; 
  INT16 a1[8]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _SID_AND_ATTRIBUTES Groups; 
  PSID v31; 
  int v32; 
  v0 = (char *)ExLeapSecondData;
  TokenHandle = 0i64;
  *(&User.Attributes + 1) = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  ExpirationTime.QuadPart = 0i64;
  MandatoryPolicy.Policy = 1;
  a2.QuadPart = 0i64;
  *(__m128i *)a1 = _mm_load_si128((const __m128i *)&_xmm);
  if( !ExLeapSecondData || !*(_BYTE *)ExLeapSecondData )
  {
    RtlpTimeFieldsToTimeNoLeapSeconds(a1, &ExpirationTime);
    goto LABEL_6;
  }
  v1 = *((_DWORD *)ExLeapSecondData + 1);
  _InterlockedOr(v17, 0);
  if( !RtlpTimeFieldsToTimeNoLeapSeconds(a1, &a2) )
    goto LABEL_6;
  v2 = a2;
  v3 = 0;
  if( !v1 )
    goto LABEL_5;
  v14 = (__int64 *)(v0 + 8);
  while( 1 )
  {
    v15 = *v14;
    if( *v14 >= 0 )
    {
      if( v2.QuadPart < v15 + 10000000 )
      {
        if( v2.QuadPart < v15 )
          goto LABEL_5;
        v2.QuadPart = 2 * v2.QuadPart - v15;
      }
      else
      {
        v2.QuadPart += 10000000i64;
      }
      goto LABEL_17;
    }
    v16 = v15 & 0x7FFFFFFFFFFFFFFFi64;
    if( v2.QuadPart < v16 + 10000000 )
      break;
    v2.QuadPart -= 10000000i64;
LABEL_17:
    ++v3;
    ++v14;
    if( v3 >= v1 )
      goto LABEL_5;
  }
  if( v2.QuadPart < v16 )
LABEL_5:
    ExpirationTime = v2;
LABEL_6:
  PrimaryGroup = SeAnonymousLogonSid;
  Groups.Sid = SeWorldSid;
  v31 = SeLowMandatorySid;
  User.Sid = SeAnonymousLogonSid;
  User.Attributes = 0;
  Groups.Attributes = 7;
  v32 = 96;
  v5 = ((4 * *((unsigned __int8 *)SeWorldSid + 1) + 11) & 0xFFFFFFFC)
     + 16
     + ((4 * *((unsigned __int8 *)SeLowMandatorySid + 1) + 11) & 0xFFFFFFFC);
  v6 = 4 * (*((unsigned __int8 *)SeAnonymousLogonSid + 1) + *((unsigned __int8 *)SeWorldSid + 1)) + 48;
  PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, 0xC8ui64, 0x63416553ui64);
  DefaultDacl = PoolWithTag;
  if( PoolWithTag )
  {
    RtlCreateAcl(PoolWithTag, v6, 2u);
    RtlAddAccessAllowedAce(DefaultDacl, 2u, 0xF01FFu, SeWorldSid);
    RtlAddAccessAllowedAce(DefaultDacl, 2u, 0xF01FFu, SeAnonymousLogonSid);
    v9 = ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x64536553ui64);
    v10 = v9;
    if( v9 )
    {
      RtlCreateSecurityDescriptor(v9, 1ui64);
      RtlSetDaclSecurityDescriptor(v10, 1u, DefaultDacl, 0);
      RtlSetOwnerSecurityDescriptor(v10, SeWorldSid, 0);
      RtlSetGroupSecurityDescriptor(v10, SeWorldSid, 0);
      LODWORD(PrivilegeCount) = 0;
      LODWORD(GroupsLength) = v5;
      v18[0] = 2;
      ObjectAttributes.Length = 48;
      memset(&ObjectAttributes.RootDirectory, 0, 20);
      ObjectAttributes.SecurityDescriptor = v10;
      ObjectAttributes.SecurityQualityOfService = 0i64;
      SepCreateToken(
        &TokenHandle,
        v11,
        v12,
        &ObjectAttributes,
        (_TOKEN_TYPE)v17[8],
        (_SECURITY_IMPERSONATION_LEVEL)v17[10],
        (_LUID *)&SeAnonymousAuthenticationId,
        &ExpirationTime,
        &User,
        *(UINT64 *)v18,
        &Groups,
        GroupsLength,
        PrivilegeCount,
        0i64,
        0i64,
        PrimaryGroup,
        DefaultDacl,
        v21,
        v22);
      SeSetMandatoryPolicyToken(TokenHandle, &MandatoryPolicy);
      ExFreePoolWithTag(DefaultDacl, 0);
      ExFreePoolWithTag(v10, 0);
      return TokenHandle;
    }
    ExFreePoolWithTag(DefaultDacl, 0);
  }
  return 0i64;
}

Referenced by: