CmpCreateRegistryProcessToken

INT64 __fastcall CmpCreateRegistryProcessToken(VOID **a1){
  _ADAPTER_OBJECT *v2; 
  _TOKEN_GROUPS *v3; 
  _ADAPTER_OBJECT *v4; 
  NTSTATUS v5; 
  char *TransientPoolWithTag; 
  PVOID P; 
  PACCESS_TOKEN NewToken; 
  VOID *TokenInformation; 

  TokenInformation = 0i64;
  v2 = 0i64;
  P = 0i64;
  v3 = 0i64;
  NewToken = 0i64;
  v4 = (_ADAPTER_OBJECT *)PsReferencePrimaryToken(PsInitialSystemProcess);
  v5 = SeQueryInformationToken(v4, TokenUser, &TokenInformation);
  if( v5 >= 0 )
  {
    v5 = SeQueryInformationToken(v4, TokenGroups, &P);
    if( v5 >= 0 )
    {
      TransientPoolWithTag = (char *)CmpAllocateTransientPoolWithTag(
                                       1ui64,
                                       16i64 * (unsigned int)(*(_DWORD *)P + 1) + 8);
      v3 = (_TOKEN_GROUPS *)TransientPoolWithTag;
      if( TransientPoolWithTag )
      {
        *(_DWORD *)TransientPoolWithTag = *(_DWORD *)P + 1;
        *(_OWORD *)(TransientPoolWithTag + 8) = *(_OWORD *)TokenInformation;
        memmove(TransientPoolWithTag + 24, (char *)P + 8, 16 * *(_DWORD *)P);
        v5 = SeFilterToken(v4, 1ui64, v3, 0i64, 0i64, &NewToken);
        if( v5 < 0 )
        {
          v2 = (_ADAPTER_OBJECT *)NewToken;
        }
        else
        {
          v5 = 0;
          *a1 = NewToken;
        }
      }
      else
      {
        v5 = -1073741670;
      }
    }
  }
  if( v4 )
    HalPutDmaAdapter(v4);
  if( v2 )
    HalPutDmaAdapter(v2);
  if( TokenInformation )
    ExFreePoolWithTag(TokenInformation, 0);
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v3 )
    CmSiFreeMemory((PPRIVILEGE_SET)v3);
  return(unsigned int)v5;
}

Referenced by: