RtlpQueryLowBoxId

UINT64 __stdcall RtlpQueryLowBoxId(){
  _ADAPTER_OBJECT *v0; 
  _TOKEN_TYPE v1; 
  _ADAPTER_OBJECT *v2; 
  _ADAPTER_OBJECT *v4; 
  VOID *TokenInformation; 
  UINT8 EffectiveOnly; 
  _TOKEN_TYPE TokenType; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; 
  VOID *v9; 

  LODWORD(v9) = 0;
  TokenType = 0;
  ImpersonationLevel = SecurityAnonymous;
  EffectiveOnly = 0;
  v0 = (_ADAPTER_OBJECT *)PsReferenceEffectiveToken(
                            (_ETHREAD *)KeGetCurrentThread(),
                            &TokenType,
                            &EffectiveOnly,
                            &ImpersonationLevel,
                            0i64);
  v1 = TokenType;
  v2 = v0;
  if( TokenType == TokenImpersonation && ImpersonationLevel < SecurityImpersonation )
  {
    v4 = (_ADAPTER_OBJECT *)PsReferencePrimaryToken(KeGetCurrentThread()->ApcState.Process);
    SeQueryInformationToken(v4, TokenIsAppContainer, &v9);
    if( (_DWORD)v9 == 1 )
    {
      if( v2 )
        HalPutDmaAdapter(v2);
      v2 = v4;
      v1 = TokenPrimary;
    }
    else
    {
      HalPutDmaAdapter(v4);
      v1 = TokenType;
    }
  }
  LODWORD(TokenInformation) = 0;
  SeQueryInformationToken(v2, TokenAppContainerNumber, &TokenInformation);
  if( v1 == TokenPrimary || v2 )
    HalPutDmaAdapter(v2);
  return(unsigned int)TokenInformation;
}

Referenced by: