SeMakeAnonymousLogonTokenNoEveryone

VOID *__stdcall SeMakeAnonymousLogonTokenNoEveryone(){
  __int64 v0; 
  unsigned int v1; 
  signed __int64 v2; 
  unsigned int v3; 
  VOID *SystemToken; 
  unsigned int v5; 
  unsigned int v6; 
  VOID **PoolWithTag; 
  UINT64 v8; 
  _ACL *v9; 
  VOID **v10; 
  VOID **v11; 
  _OBJECT_ATTRIBUTES *v12; 
  _LUID *v13; 
  __int64 *v15; 
  __int64 v16; 
  __int64 v17; 
  int v18[8]; 
  __int64 v19; 
  __int64 v20; 
  _LUID_AND_ATTRIBUTES *Privileges; 
  VOID *PrimaryGroup; 
  _ACL *DefaultDacl; 
  _TOKEN_SOURCE *v24; 
  UINT8 v25; 
  _TOKEN_MANDATORY_POLICY MandatoryPolicy; 
  __int64 v27; 
  UINT64 GroupsLength; 
  VOID *TokenHandle; 
  _SID_AND_ATTRIBUTES PrivilegeCount; 
  __m128i si128; 
  _OBJECT_ATTRIBUTES ExpirationTime; 
  VOID *Owner; 
  int v34; 

  v0 = *(&ExBootDevicesRemovedEvent + 103);
  TokenHandle = 0i64;
  *(&PrivilegeCount.Attributes + 1) = 0;
  *(&ExpirationTime.Length + 1) = 0;
  MandatoryPolicy.Policy = 1;
  *(&ExpirationTime.Attributes + 1) = 0;
  GroupsLength = 0i64;
  v27 = 0i64;
  si128 = _mm_load_si128((const __m128i *)&_xmm);
  if( !*(&ExBootDevicesRemovedEvent + 103) || !**(&ExBootDevicesRemovedEvent + 103) )
  {
    RtlpTimeFieldsToTimeNoLeapSeconds(si128.m128i_i16, &GroupsLength);
    goto LABEL_6;
  }
  v1 = *(_DWORD *)(*(&ExBootDevicesRemovedEvent + 103) + 4i64);
  _InterlockedOr(v18, 0);
  if( !RtlpTimeFieldsToTimeNoLeapSeconds(si128.m128i_i16, &v27) )
    goto LABEL_6;
  v2 = v27;
  v3 = 0;
  if( !v1 )
    goto LABEL_5;
  v15 = (__int64 *)(v0 + 8);
  while( 1 )
  {
    v16 = *v15;
    if( *v15 >= 0 )
    {
      if( v2 < v16 + 10000000 )
      {
        if( v2 < v16 )
          goto LABEL_5;
        v2 = 2 * v2 - v16;
      }
      else
      {
        v2 += 10000000i64;
      }
      goto LABEL_17;
    }
    v17 = v16 & 0x7FFFFFFFFFFFFFFFi64;
    if( v2 < v17 + 10000000 )
      break;
    v2 -= 10000000i64;
LABEL_17:
    ++v3;
    ++v15;
    if( v3 >= v1 )
      goto LABEL_5;
  }
  if( v2 < v17 )
LABEL_5:
    GroupsLength = v2;
LABEL_6:
  SystemToken = SeAnonymousLogonSid;
  Owner = SeUntrustedMandatorySid;
  PrivilegeCount.Sid = SeAnonymousLogonSid;
  PrivilegeCount.Attributes = 0;
  v34 = 96;
  v5 = ((4 * *((unsigned __int8 *)SeUntrustedMandatorySid + 1) + 11) & 0xFFFFFFFC) + 16;
  v6 = 4 * (*((unsigned __int8 *)SeAnonymousLogonSid + 1) + *((unsigned __int8 *)SeWorldSid + 1)) + 48;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0xC8ui64, 1665230163i64);
  v9 = (_ACL *)PoolWithTag;
  if( PoolWithTag )
  {
    RtlCreateAcl((PACL)PoolWithTag, (_ACL)v6, 2ui64, v8);
    RtlAddAccessAllowedAce(v9, 2ui64, 983551, SeWorldSid);
    RtlAddAccessAllowedAce(v9, 2ui64, 983551, SeAnonymousLogonSid);
    v10 = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1683187027i64);
    v11 = v10;
    if( v10 )
    {
      RtlCreateSecurityDescriptor(v10, 1ui64);
      RtlSetDaclSecurityDescriptor(v11, 1u, v9, 0);
      RtlSetOwnerSecurityDescriptor(v11, SeWorldSid, 0);
      RtlSetGroupSecurityDescriptor(v11, SeWorldSid, 0);
      LODWORD(DefaultDacl) = 0;
      LODWORD(PrimaryGroup) = v5;
      LODWORD(Privileges) = 1;
      ExpirationTime.Length = 48;
      memset(&ExpirationTime.RootDirectory, 0, 20);
      ExpirationTime.SecurityDescriptor = v11;
      ExpirationTime.SecurityQualityOfService = 0i64;
      SepCreateToken(
        &TokenHandle,
        v12,
        v13,
        &ExpirationTime,
        (_TOKEN_TYPE)v19,
        (_SECURITY_IMPERSONATION_LEVEL)v20,
        (_SID_AND_ATTRIBUTES *)&SeAnonymousAuthenticationId,
        (_LARGE_INTEGER *)&GroupsLength,
        &PrivilegeCount,
        Privileges,
        &Owner,
        PrimaryGroup,
        DefaultDacl,
        0i64,
        0i64,
        SystemToken,
        v9,
        v24,
        v25);
      SeSetMandatoryPolicyToken(TokenHandle, &MandatoryPolicy);
      ExFreePoolWithTag(v9, 0);
      ExFreePoolWithTag(v11, 0);
      return TokenHandle;
    }
    ExFreePoolWithTag(v9, 0);
  }
  return 0i64;
}

Referenced by: