SeExchangePrimaryToken

NTSTATUS __stdcall SeExchangePrimaryToken(_EPROCESS *Process, VOID *NewAccessToken, VOID **OldAccessToken){
  bool v4; 
  _ADAPTER_OBJECT *SessionObjectById; 
  unsigned int SessionId; 
  NTSTATUS v9; 
  _ETHREAD *CurrentThread; 
  unsigned int v11; 
  INT64 v12; 
  int v13; 
  VOID *v14; 
  UINT64 v15; 
  _QWORD *v16; 
  INT64 v17; 
  _ETHREAD *v18; 
  NTSTATUS result; 
  _ADAPTER_OBJECT *v20; 
  UINT64 v21; 
  VOID *v22; 
  signed __int32 v23[8]; 
  UINT8 TokenChanged; 
  PADAPTER_OBJECT DmaAdapter; 

  v4 = *((_DWORD *)NewAccessToken + 48) == 1;
  DmaAdapter = 0i64;
  SessionObjectById = 0i64;
  TokenChanged = 0;
  if( !v4 )
    return -1073741656;
  SessionId = MmGetSessionIdEx(Process);
  if( SessionId != -1 && !SeTokenDoesNotTrackSessionObject )
    SessionObjectById = (_ADAPTER_OBJECT *)MmGetSessionObjectById(SessionId);
  v9 = MmGetSessionId(Process);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v11 = v9;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceExclusiveLite(*((_QWORD *)NewAccessToken + 6), 1, v12);
  _InterlockedOr(v23, 0);
  if( *((_BYTE *)NewAccessToken + 204) )
  {
    _InterlockedOr(v23, 0);
    ExReleaseResourceLite(*((PERESOURCE *)NewAccessToken + 6));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    if( SessionObjectById )
      HalPutDmaAdapter(SessionObjectById);
    return -1073741525;
  }
  else
  {
    *((_BYTE *)NewAccessToken + 204) = 1;
    v13 = SepSetTrustLevelForProcessToken(NewAccessToken, Process, &TokenChanged);
    if( v13 < 0 )
    {
      _InterlockedOr(v23, 0);
      ExReleaseResourceLite(*((PERESOURCE *)NewAccessToken + 6));
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      if( !SessionObjectById )
        return v13;
      v20 = SessionObjectById;
LABEL_21:
      HalPutDmaAdapter(v20);
      return v13;
    }
    if( (*((_DWORD *)NewAccessToken + 50) & 0x4000) != 0 )
    {
      v21 = *((unsigned int *)NewAccessToken + 30);
      if( (_DWORD)v21 != v11 )
      {
        SepDereferenceLowBoxNumberEntry(v21, *((PVOID *)NewAccessToken + 135));
        *((_QWORD *)NewAccessToken + 135) = 0i64;
        SepSetTokenSessionById((__int64)NewAccessToken, v11, 1, (__int64)SessionObjectById, &DmaAdapter);
        v22 = (VOID *)*((_QWORD *)NewAccessToken + 98);
        *((_DWORD *)NewAccessToken + 30) = v11;
        v13 = SepSetTokenLowboxNumber((_TOKEN *)NewAccessToken, v22);
        if( v13 < 0 )
        {
          _InterlockedOr(v23, 0);
          ExReleaseResourceLite(*((PERESOURCE *)NewAccessToken + 6));
          KeLeaveCriticalRegionThread(KeGetCurrentThread());
          v20 = DmaAdapter;
          if( !DmaAdapter )
            return v13;
          goto LABEL_21;
        }
      }
    }
    SepSetTokenSessionById((__int64)NewAccessToken, v11, 1, (__int64)SessionObjectById, &DmaAdapter);
    *((_DWORD *)NewAccessToken + 30) = v11;
    _InterlockedOr(v23, 0);
    ExReleaseResourceLite(*((PERESOURCE *)NewAccessToken + 6));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    if( DmaAdapter )
      HalPutDmaAdapter(DmaAdapter);
    if( SeAuditingWithTokenForSubcategory(133i64, 0i64) )
      SepAuditAssignPrimaryToken(Process, NewAccessToken, v14);
    ObfReferenceObject(NewAccessToken);
    v16 = ObFastReplaceObject(&Process->Token, NewAccessToken, v15);
    if( v16 )
    {
      v18 = (_ETHREAD *)KeGetCurrentThread();
      --v18->Tcb.KernelApcDisable;
      ExAcquireResourceExclusiveLite(v16[6], 1, v17);
      _InterlockedOr(v23, 0);
      *((_BYTE *)v16 + 204) = 0;
      _InterlockedOr(v23, 0);
      ExReleaseResourceLite((PERESOURCE)v16[6]);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      result = 0;
      *OldAccessToken = v16;
    }
    else
    {
      return -1073741700;
    }
  }
  return result;
}

Referenced by: