NtFilterToken

NTSTATUS __stdcall NtFilterToken(
        PVOID ExistingTokenHandle,
        UINT64 Flags,
        _TOKEN_GROUPS *SidsToDisable,
        _TOKEN_PRIVILEGES *PrivilegesToDelete,
        _TOKEN_GROUPS *RestrictedSids,
        PVOID *NewTokenHandle){
  CHAR v7; 
  __int64 v8; 
  unsigned int v9; 
  NTSTATUS inserted; 
  unsigned int i; 
  UINT64 v12; 
  PVOID *Object; 
  PVOID *Objecta; 
  _POOL_TYPE HandleInformation; 
  POBJECT_HANDLE_INFORMATION HandleInformationa; 
  UINT8 PrivilegesToDeletea; 
  _SID_AND_ATTRIBUTES **CapturedArray; 
  UINT64 ulAddend; 
  UINT64 ArrayCount; 
  ULONG v22[2]; 
  PADAPTER_OBJECT DmaAdapter; 
  _SID_AND_ATTRIBUTES *v24; 
  unsigned int v25; 
  UINT64 AlignedArraySize; 
  PVOID v27; 
  _SID_AND_ATTRIBUTES *GroupsToDisable; 
  _LUID_AND_ATTRIBUTES *v29; 
  struct _OBJECT_HANDLE_INFORMATION v30; 
  PVOID v31; 
  unsigned int Flagsa; 
  Flagsa = Flags;
  DmaAdapter = 0i64;
  v24 = 0i64;
  v22[0] = 0;
  ArrayCount = 0i64;
  GroupsToDisable = 0i64;
  AlignedArraySize = 0i64;
  v22[1] = 0;
  v29 = 0i64;
  v31 = 0i64;
  v30 = 0i64;
  v7 = *((_BYTE *)KeGetCurrentThread() + 562);
  v8 = 0x7FFFFFFF0000i64;
  if( (unsigned __int64)NewTokenHandle < 0x7FFFFFFF0000i64 )
    v8 = (__int64)NewTokenHandle;
  *(_QWORD *)v8 = *(_QWORD *)v8;
  if( SidsToDisable )
  {
    if( ((unsigned __int8)SidsToDisable & 3) != 0 )
      goto LABEL_18;
    LODWORD(ArrayCount) = SidsToDisable->GroupCount;
    v9 = 0;
    v25 = 0;
    while( v9 < (unsigned int)ArrayCount )
    {
      *(&SidsToDisable->GroupCount + 4 * ++v9) = 0;
      v25 = v9;
    }
    LODWORD(Object) = 0;
    inserted = SeCaptureSidAndAttributesArray(
                 SidsToDisable->Groups,
                 (unsigned int)ArrayCount,
                 v7,
                 0i64,
                 (UINT64)Object,
                 HandleInformation,
                 PrivilegesToDeletea,
                 &GroupsToDisable,
                 &AlignedArraySize);
  }
  else
  {
    inserted = 0;
  }
  if( inserted < 0 )
    goto LABEL_19;
  if( PrivilegesToDelete )
  {
    if( ((unsigned __int8)PrivilegesToDelete & 3) != 0 )
      goto LABEL_18;
    v22[1] = PrivilegesToDelete->PrivilegeCount;
    CapturedArray = (_SID_AND_ATTRIBUTES **)&v29;
    inserted = SeCaptureLuidAndAttributesArray(
                 PrivilegesToDelete->Privileges,
                 v22[1],
                 v7,
                 (LUID_AND_ATTRIBUTES **)PrivilegesToDelete,
                 (UINT64 *)Object);
  }
  if( inserted >= 0 && RestrictedSids )
  {
    if( ((unsigned __int8)RestrictedSids & 3) == 0 )
    {
      HIDWORD(ArrayCount) = RestrictedSids->GroupCount;
      LODWORD(Object) = 0;
      inserted = SeCaptureSidAndAttributesArray(
                   RestrictedSids->Groups,
                   RestrictedSids->GroupCount,
                   v7,
                   0i64,
                   (UINT64)Object,
                   HandleInformation,
                   PrivilegesToDeletea,
                   &v24,
                   (UINT64 *)v22);
      goto LABEL_19;
    }
LABEL_18:
    ExRaiseDatatypeMisalignment();
  }
LABEL_19:
  if( inserted >= 0 )
  {
    for( i = 0; i < HIDWORD(ArrayCount); ++i )
    {
      if( v24[i].Attributes )
      {
        inserted = -1073741811;
        goto LABEL_30;
      }
    }
    v27 = 0i64;
    inserted = ObReferenceObjectByHandle(ExistingTokenHandle, 2u, (POBJECT_TYPE)SeTokenObjectType, v7, &v27, &v30);
    if( inserted >= 0 )
    {
      DmaAdapter = 0i64;
      LODWORD(ulAddend) = v22[0];
      LODWORD(CapturedArray) = HIDWORD(ArrayCount);
      LODWORD(HandleInformationa) = v22[1];
      LOBYTE(v12) = v7;
      inserted = SepFilterToken(
                   (_TOKEN *)v27,
                   v12,
                   Flagsa,
                   (unsigned int)ArrayCount,
                   GroupsToDisable,
                   (UINT64)HandleInformationa,
                   v29,
                   (UINT64)CapturedArray,
                   v24,
                   ulAddend,
                   (_TOKEN **)&DmaAdapter);
      if( inserted >= 0 )
      {
        LODWORD(Objecta) = 0;
        inserted = ObInsertObjectEx(DmaAdapter, 0i64, v30.GrantedAccess, 1ui64, (UINT64)Objecta, 0i64, &v31);
        if( inserted >= 0 )
        {
          SepAppendAceToTokenObjectAcl((_TOKEN *)DmaAdapter, 8ui64, SeAliasAdminsSid);
          HalPutDmaAdapter(DmaAdapter);
        }
      }
      HalPutDmaAdapter((PADAPTER_OBJECT)v27);
      if( inserted >= 0 )
        *NewTokenHandle = v31;
    }
  }
LABEL_30:
  if( GroupsToDisable )
    SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)GroupsToDisable, v7);
  if( v29 )
    SeReleaseLuidAndAttributesArray(v29, v7);
  if( v24 )
    SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)v24, v7);
  return inserted;
}

Referenced by: