SepLinkLogonSessions

INT64 __fastcall SepLinkLogonSessions(_TOKEN *pAdminToken, VOID *hLUAToken, CHAR PreviousMode){
  _TOKEN *v5; 
  _QWORD *v6; 
  NTSTATUS v8; 
  int v9; 
  _SEP_LOGON_SESSION_REFERENCES *v10; 
  _SEP_LOGON_SESSION_REFERENCES *LogonSession; 
  PVOID v13; 
  PVOID Object; 
  _QWORD *v15; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID DuplicateToken; 
  v13 = 0i64;
  DuplicateToken = 0i64;
  v5 = 0i64;
  v15 = 0i64;
  v6 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreateTokenPrivilege, PreviousMode) )
  {
    v9 = -1073741727;
    goto LABEL_20;
  }
  if( pAdminToken->LogonSession->Token )
    goto LABEL_26;
  Object = 0i64;
  v8 = ObReferenceObjectByHandle(hLUAToken, 0x88u, (POBJECT_TYPE)SeTokenObjectType, PreviousMode, &Object, 0i64);
  v5 = (_TOKEN *)Object;
  v9 = v8;
  if( v8 < 0 )
  {
LABEL_20:
    if( v13 )
      ObfDereferenceObjectWithTag(v13, 0x746C6644ui64);
    if( DuplicateToken )
      ObfDereferenceObjectWithTag(DuplicateToken, 0x746C6644ui64);
    if( v6 )
      SepDeReferenceLogonSessionDirect(v6);
    goto LABEL_15;
  }
  v10 = (_SEP_LOGON_SESSION_REFERENCES *)*((_QWORD *)Object + 27);
  if( v10->Token )
    goto LABEL_26;
  LogonSession = pAdminToken->LogonSession;
  if( LogonSession == v10 )
  {
    LogonSession->Flags |= 4u;
    v9 = 0;
    goto LABEL_15;
  }
  if( pAdminToken->TokenType != TokenPrimary || *((_DWORD *)Object + 48) != 1 )
  {
LABEL_26:
    v9 = -1073741811;
    goto LABEL_20;
  }
  ObjectAttributes.Length = 48;
  memset(&ObjectAttributes.RootDirectory, 0, 20);
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v9 = SepDuplicateToken(
         pAdminToken,
         &ObjectAttributes,
         0,
         TokenPrimary,
         SecurityAnonymous,
         0,
         0,
         (_TOKEN **)&DuplicateToken);
  if( v9 < 0 )
    goto LABEL_20;
  v9 = SepDuplicateToken(v5, &ObjectAttributes, 0, TokenPrimary, SecurityAnonymous, 0, 0, (_TOKEN **)&v13);
  if( v9 < 0 )
    goto LABEL_20;
  v9 = SepReferenceLogonSession((_DWORD *)DuplicateToken + 6, (__int64 *)&v15);
  if( v9 < 0 )
    goto LABEL_18;
  *(_QWORD *)(*((_QWORD *)DuplicateToken + 27) + 48i64) = DuplicateToken;
  *(_QWORD *)(*((_QWORD *)DuplicateToken + 27) + 16i64) = *(_QWORD *)(*((_QWORD *)v13 + 27) + 8i64);
  *(_DWORD *)(*((_QWORD *)DuplicateToken + 27) + 32i64) |= 2u;
  *(_QWORD *)(*((_QWORD *)v13 + 27) + 48i64) = v13;
  *(_QWORD *)(*((_QWORD *)v13 + 27) + 16i64) = *(_QWORD *)(*((_QWORD *)DuplicateToken + 27) + 8i64);
  *(_DWORD *)(*((_QWORD *)v13 + 27) + 32i64) |= 4u;
  if( SeTokenLeakTracking )
  {
    SepRemoveTokenLogonSession((INT64)v13);
    SepRemoveTokenLogonSession((INT64)DuplicateToken);
  }
  v9 = SepStopReferencingLogonSession((_TOKEN *)v13);
  if( v9 < 0 || (v9 = SepStopReferencingLogonSession((_TOKEN *)DuplicateToken), v9 < 0) )
  {
LABEL_18:
    v6 = v15;
    goto LABEL_20;
  }
LABEL_15:
  if( v5 )
    ObfDereferenceObjectWithTag(v5, 0x746C6644ui64);
  return(unsigned int)v9;
}

Referenced by: