SeQueryInformationToken

NTSTATUS __stdcall SeQueryInformationToken(
        VOID *AccessToken,
        _TOKEN_INFORMATION_CLASS TokenInformationClass,
        VOID **TokenInformation){
  char *v3; 
  unsigned int v7; 
  unsigned int v8; 
  NTSTATUS result; 
  _ETHREAD *CurrentThread; 
  unsigned int v11; 
  _SID_AND_ATTRIBUTES *PoolWithTag; 
  _DWORD *v13; 
  _ETHREAD *v14; 
  __int64 v15; 
  VOID **v16; 
  _ETHREAD *v17; 
  unsigned int v18; 
  bool v19; 
  INT8 IsElevatedRid; 
  VOID **v21; 
  int v22; 
  _ETHREAD *v23; 
  void *Sid; 
  unsigned __int8 *v25; 
  int v26; 
  _DWORD *v27; 
  VOID **v28; 
  _ETHREAD *v29; 
  __int64 v30; 
  int v31; 
  int v32; 
  _ETHREAD *v33; 
  VOID **v34; 
  unsigned int v35; 
  VOID **v36; 
  VOID **v37; 
  _ETHREAD *v38; 
  unsigned int v39; 
  unsigned int v40; 
  unsigned int v41; 
  __int64 *v42; 
  __int64 v43; 
  __int64 v44; 
  VOID **v45; 
  VOID *v46; 
  _BOOL4 v47; 
  _ETHREAD *v48; 
  unsigned int v49; 
  VOID **v50; 
  _ETHREAD *v51; 
  unsigned int TokenAccessInformationBufferSize; 
  _TOKEN_ACCESS_INFORMATION *v53; 
  _ETHREAD *v54; 
  unsigned int v55; 
  unsigned int v56; 
  unsigned int v57; 
  __int64 v58; 
  __int64 *v59; 
  __int64 v60; 
  VOID **v61; 
  VOID **v62; 
  _ETHREAD *v63; 
  unsigned int v64; 
  VOID **v65; 
  VOID **v66; 
  _ETHREAD *v67; 
  INT16 v68; 
  unsigned int v69; 
  unsigned int v70; 
  VOID **v71; 
  _ETHREAD *v72; 
  INT16 v73; 
  unsigned int v74; 
  int v75; 
  int v76; 
  unsigned int v77; 
  __int64 *v78; 
  __int64 v79; 
  __int64 v80; 
  unsigned int v81; 
  unsigned int v82; 
  __int64 *v83; 
  __int64 v84; 
  __int64 v85; 
  VOID **v86; 
  VOID **v87; 
  VOID **v88; 
  char *v89; 
  __int64 v90; 
  unsigned int v91; 
  _ETHREAD *v92; 
  __int64 v93; 
  UINT64 v94; 
  VOID **v95; 
  VOID *v96; 
  VOID **v97; 
  VOID **v98; 
  _ETHREAD *v99; 
  __int64 v100; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v101; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v102; 
  unsigned int v103; 
  VOID **v104; 
  VOID **v105; 
  int v106; 
  _ETHREAD *v107; 
  unsigned int *v108; 
  unsigned int v109; 
  unsigned int v110; 
  unsigned int v111; 
  __int64 *v112; 
  __int64 v113; 
  __int64 v114; 
  VOID **v115; 
  _ETHREAD *v116; 
  _ETHREAD *v117; 
  __int64 v118; 
  UINT64 v119; 
  VOID *TargetSid; 
  VOID **NextTargetSid; 
  VOID **NextTargetSida; 
  UINT64 *RemainingTargetSidBufferSize; 
  UINT64 *pRestrictedSidsSALength; 
  UINT64 *pPackageSidLength; 
  UINT64 *pCapabilitySidsLength; 
  UINT64 *pCapabilitySidsSALength; 
  UINT64 *pTrustSidLength; 
  UINT64 *pSecurityAttributesLength; 
  UINT64 RemainingTargetSufferSize; 
  UINT64 pPrivilegeCount; 
  UINT64 PackageSidLength; 
  UINT64 pRestrictedSidsLength; 
  UINT64 pGroupsLength; 
  __int128 v135; 
  __int128 v136; 
  __int128 v137; 
  _SID_AND_ATTRIBUTES IntegritySA; 
  UINT64 SecurityAttributesLength; 
  UINT64 pReturnLength; 
  UINT64 TrustSidLength; 

  v3 = 0i64;
  LODWORD(pReturnLength) = 0;
  LODWORD(pPrivilegeCount) = 0;
  v135 = 0i64;
  v136 = 0i64;
  v137 = 0i64;
  if( TokenInformationClass == TokenVirtualizationEnabled )
  {
LABEL_2:
    v7 = *((_DWORD *)AccessToken + 50);
    if( TokenInformationClass == TokenVirtualizationAllowed )
    {
      *(_DWORD *)TokenInformation = (*((_DWORD *)AccessToken + 50) & 0x200) != 0;
    }
    else
    {
      switch( TokenInformationClass )
      {
        case TokenVirtualizationEnabled:
          v8 = v7 >> 10;
          break;
        case TokenUIAccess:
          v8 = v7 >> 12;
          break;
        case TokenIsAppContainer:
          v8 = v7 >> 14;
          break;
        case TokenHasRestrictions:
          *(_BYTE *)TokenInformation = (*((_DWORD *)AccessToken + 50) & 0x810) != 0;
          return 0;
        default:
          v8 = HIWORD(v7);
          break;
      }
      *(_DWORD *)TokenInformation = v8 & 1;
    }
  }
  else
  {
    switch( TokenInformationClass )
    {
      case TokenUser:
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --CurrentThread->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v11 = 4 * *(unsigned __int8 *)(**((_QWORD **)AccessToken + 19) + 1i64) + 24;
        PoolWithTag = (_SID_AND_ATTRIBUTES *)ExAllocatePoolWithTag(1ui64, v11, 538994003i64);
        v13 = PoolWithTag;
        if( !PoolWithTag )
          goto LABEL_70;
        RtlCopySidAndAttributesArray(
          1ui64,
          *((_SID_AND_ATTRIBUTES **)AccessToken + 19),
          v11,
          PoolWithTag,
          &PoolWithTag[1],
          (VOID **)&RemainingTargetSufferSize,
          &RemainingTargetSufferSize);
        goto LABEL_10;
      case TokenGroups:
        v54 = (_ETHREAD *)KeGetCurrentThread();
        --v54->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v55 = *((_DWORD *)AccessToken + 31);
        v56 = 16 * v55 - 8;
        v57 = v56;
        if( v55 > 1 )
        {
          v58 = v55 - 1;
          v59 = (__int64 *)(*((_QWORD *)AccessToken + 19) + 16i64);
          do
          {
            v60 = *v59;
            v59 += 2;
            v56 += 4 * *(unsigned __int8 *)(v60 + 1) + 8;
            v57 = v56;
            --v58;
          }
          while( v58 );
        }
        v61 = ExAllocatePoolWithTag(1ui64, v57, 538994003i64);
        v62 = v61;
        if( !v61 )
          goto LABEL_70;
        *(_DWORD *)v61 = *((_DWORD *)AccessToken + 31) - 1;
        RtlCopySidAndAttributesArray(
          (unsigned int)(*((_DWORD *)AccessToken + 31) - 1),
          (_SID_AND_ATTRIBUTES *)(*((_QWORD *)AccessToken + 19) + 16i64),
          v56,
          (_SID_AND_ATTRIBUTES *)(v61 + 1),
          (char *)v61 + (unsigned int)(16 * *((_DWORD *)AccessToken + 31) - 32) + 24,
          (VOID **)&RemainingTargetSufferSize,
          &RemainingTargetSufferSize);
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        result = 0;
        *TokenInformation = v62;
        return result;
      case TokenPrivileges:
        v67 = (_ETHREAD *)KeGetCurrentThread();
        --v67->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        SepTokenPrivilegeCount((_TOKEN *)AccessToken, v68);
        if( v69 <= 1 )
          v70 = 16;
        else
          v70 = 12 * v69 + 4;
        v71 = ExAllocatePoolWithTag(1ui64, v70, 538994003i64);
        v13 = v71;
        if( !v71 )
          goto LABEL_70;
        SepConvertTokenPrivileges((_TOKEN *)AccessToken, (_TOKEN_PRIVILEGES *)v71);
        goto LABEL_10;
      case TokenOwner:
        v63 = (_ETHREAD *)KeGetCurrentThread();
        --v63->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v64 = 4
            * *(unsigned __int8 *)(*(_QWORD *)(*((_QWORD *)AccessToken + 19)
                                             + 16i64 * *((unsigned int *)AccessToken + 36))
                                 + 1i64)
            + 16;
        v65 = ExAllocatePoolWithTag(1ui64, v64, 538994003i64);
        v13 = v65;
        if( !v65 )
          goto LABEL_70;
        *v65 = v65 + 1;
        RtlCopySid(
          v64 - 8,
          v65 + 1,
          *(VOID **)(*((_QWORD *)AccessToken + 19) + 16i64 * *((unsigned int *)AccessToken + 36)));
        goto LABEL_10;
      case TokenPrimaryGroup:
        v48 = (_ETHREAD *)KeGetCurrentThread();
        --v48->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v49 = 4 * *(unsigned __int8 *)(*((_QWORD *)AccessToken + 21) + 1i64) + 16;
        v50 = ExAllocatePoolWithTag(1ui64, v49, 538994003i64);
        v13 = v50;
        if( !v50 )
          goto LABEL_70;
        *v50 = v50 + 1;
        RtlCopySid(v49 - 8, v50 + 1, *((VOID **)AccessToken + 21));
        goto LABEL_10;
      case TokenDefaultDacl:
        v92 = (_ETHREAD *)KeGetCurrentThread();
        --v92->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v93 = *((_QWORD *)AccessToken + 23);
        v94 = 8i64;
        if( v93 )
          v94 = *(unsigned __int16 *)(v93 + 2) + 8i64;
        v95 = ExAllocatePoolWithTag(1ui64, v94, 538994003i64);
        v13 = v95;
        if( !v95 )
          goto LABEL_70;
        v96 = v95 + 1;
        if( !*((_QWORD *)AccessToken + 23) )
          goto LABEL_137;
        *v95 = v96;
        memmove(v96, *((const VOID **)AccessToken + 23), *(unsigned __int16 *)(*((_QWORD *)AccessToken + 23) + 2i64));
        goto LABEL_10;
      case TokenSource:
        v97 = ExAllocatePoolWithTag(1ui64, 0x10ui64, 538994003i64);
        if( !v97 )
          return -1073741670;
        *(_OWORD *)v97 = *(_OWORD *)AccessToken;
        *TokenInformation = v97;
        return 0;
      case TokenType:
        v98 = ExAllocatePoolWithTag(1ui64, 4ui64, 538994003i64);
        if( !v98 )
          return -1073741670;
        *(_DWORD *)v98 = *((_DWORD *)AccessToken + 48);
        *TokenInformation = v98;
        return 0;
      case TokenImpersonationLevel:
        if( *((_DWORD *)AccessToken + 48) != 2 )
          return -1073741821;
        v66 = ExAllocatePoolWithTag(1ui64, 4ui64, 538994003i64);
        if( !v66 )
          return -1073741670;
        *(_DWORD *)v66 = *((_DWORD *)AccessToken + 49);
        *TokenInformation = v66;
        return 0;
      case TokenStatistics:
        v28 = ExAllocatePoolWithTag(1ui64, 0x38ui64, 538994003i64);
        v13 = v28;
        if( !v28 )
          return -1073741670;
        *v28 = (VOID *)*((_QWORD *)AccessToken + 2);
        v28[1] = (VOID *)*((_QWORD *)AccessToken + 3);
        *((_DWORD *)v28 + 6) = *((_DWORD *)AccessToken + 48);
        *((_DWORD *)v28 + 7) = *((_DWORD *)AccessToken + 49);
        v28[2] = (VOID *)*((_QWORD *)AccessToken + 5);
        v29 = (_ETHREAD *)KeGetCurrentThread();
        --v29->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v13[8] = *((_DWORD *)AccessToken + 34);
        v30 = *((_QWORD *)AccessToken + 23);
        v31 = *((_DWORD *)AccessToken + 34) - 4 * *(unsigned __int8 *)(*((_QWORD *)AccessToken + 21) + 1i64) - 8;
        if( v30 )
          v31 -= *(unsigned __int16 *)(v30 + 2);
        v13[9] = v31;
        v13[9] = *((_DWORD *)AccessToken + 35);
        v13[10] = *((_DWORD *)AccessToken + 31) - 1;
        SepTokenPrivilegeCount((_TOKEN *)AccessToken, v31);
        v13[11] = v32;
        *((_QWORD *)v13 + 6) = *((_QWORD *)AccessToken + 7);
        goto LABEL_10;
      case TokenSessionId:
        SeQuerySessionIdToken(AccessToken, (UINT64 *)TokenInformation);
        return 0;
      case TokenGroupsAndPrivileges:
        v72 = (_ETHREAD *)KeGetCurrentThread();
        --v72->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        SepTokenPrivilegeCount((_TOKEN *)AccessToken, v73);
        v74 = *((_DWORD *)AccessToken + 31);
        LODWORD(SecurityAttributesLength) = v75;
        v76 = 12 * v75;
        v77 = 16 * v74;
        LODWORD(pReturnLength) = 12 * v75;
        LODWORD(TrustSidLength) = 16 * v74;
        if( v74 )
        {
          v78 = (__int64 *)*((_QWORD *)AccessToken + 19);
          v79 = v74;
          do
          {
            v80 = *v78;
            v78 += 2;
            v77 += (4 * *(unsigned __int8 *)(v80 + 1) + 15) & 0xFFFFFFF8;
            --v79;
          }
          while( v79 );
        }
        v81 = *((_DWORD *)AccessToken + 32);
        LODWORD(pPrivilegeCount) = 16 * v81;
        v82 = 16 * v81;
        if( v81 )
        {
          v83 = (__int64 *)*((_QWORD *)AccessToken + 20);
          v84 = v81;
          do
          {
            v85 = *v83;
            v83 += 2;
            v82 += (4 * *(unsigned __int8 *)(v85 + 1) + 15) & 0xFFFFFFF8;
            --v84;
          }
          while( v84 );
        }
        v86 = ExAllocatePoolWithTag(1ui64, v82 + v77 + v76 + 56, 538994003i64);
        v87 = v86;
        if( v86 )
        {
          v88 = v86 + 7;
          v86[6] = (VOID *)*((_QWORD *)AccessToken + 3);
          *((_DWORD *)v86 + 1) = v77;
          *(_DWORD *)v86 = *((_DWORD *)AccessToken + 31);
          v86[1] = v86 + 7;
          *((_DWORD *)v86 + 5) = v82;
          *((_DWORD *)v86 + 4) = *((_DWORD *)AccessToken + 32);
          if( *((_DWORD *)AccessToken + 32) )
            v3 = (char *)v88 + ((v77 + 7i64) & 0xFFFFFFFFFFFFFFF8ui64);
          v86[3] = v3;
          *((_DWORD *)v86 + 9) = pReturnLength;
          *((_DWORD *)v86 + 8) = SecurityAttributesLength;
          v89 = (char *)v88 + v77 + (unsigned __int64)v82;
          v90 = (unsigned int)TrustSidLength;
          v91 = v77 - TrustSidLength;
          v87[5] = v89;
          RtlCopySidAndAttributesArray(
            *((unsigned int *)AccessToken + 31),
            *((_SID_AND_ATTRIBUTES **)AccessToken + 19),
            v91,
            (_SID_AND_ATTRIBUTES *)(v87 + 7),
            (char *)v87 + v90 + 56,
            (VOID **)&RemainingTargetSufferSize,
            &RemainingTargetSufferSize);
          if( *((_DWORD *)v87 + 4) )
            RtlCopySidAndAttributesArray(
              *((unsigned int *)AccessToken + 32),
              *((_SID_AND_ATTRIBUTES **)AccessToken + 20),
              v82 - (unsigned int)pPrivilegeCount,
              (_SID_AND_ATTRIBUTES *)v87[3],
              (char *)v87[3] + (unsigned int)pPrivilegeCount,
              (VOID **)&RemainingTargetSufferSize,
              &RemainingTargetSufferSize);
          SepConvertTokenPrivilegesToLuidAndAttributes((_TOKEN *)AccessToken, (_LUID_AND_ATTRIBUTES *)v87[5]);
          ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
          KeLeaveCriticalRegion();
          result = 0;
          *TokenInformation = v87;
        }
        else
        {
          ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
          KeLeaveCriticalRegion();
          return -1073741670;
        }
        return result;
      case TokenElevationType:
        v21 = ExAllocatePoolWithTag(1ui64, 4ui64, 538994003i64);
        if( !v21 )
          return -1073741670;
        v22 = *(_DWORD *)(*((_QWORD *)AccessToken + 27) + 32i64);
        if( (v22 & 4) != 0 )
        {
          *(_DWORD *)v21 = 3;
        }
        else
        {
          LOBYTE(v3) = (v22 & 2) != 0;
          *(_DWORD *)v21 = (_DWORD)v3 + 1;
        }
        *TokenInformation = v21;
        return 0;
      case TokenElevation:
        v16 = ExAllocatePoolWithTag(1ui64, 4ui64, 538994003i64);
        if( !v16 )
          return -1073741670;
        v17 = (_ETHREAD *)KeGetCurrentThread();
        --v17->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v18 = *((_DWORD *)AccessToken + 31);
        v19 = (*((_QWORD *)AccessToken + 8) & 0x1120160684i64) != 0;
        if( v18 )
        {
          do
          {
            if( v19 )
              break;
            IsElevatedRid = RtlIsElevatedRid(*((_QWORD *)AccessToken + 19) + 16i64 * (unsigned int)v3);
            LODWORD(v3) = (_DWORD)v3 + 1;
            v19 = IsElevatedRid;
          }
          while( (unsigned int)v3 < v18 );
        }
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *(_DWORD *)v16 = v19;
        *TokenInformation = v16;
        return 0;
      case TokenHasRestrictions:
      case TokenVirtualizationAllowed:
      case TokenUIAccess:
      case TokenIsAppContainer:
      case TokenPrivateNameSpace:
        goto LABEL_2;
      case TokenAccessInformation:
        v51 = (_ETHREAD *)KeGetCurrentThread();
        pGroupsLength = 0i64;
        HIDWORD(pRestrictedSidsLength) = 0;
        --v51->Tcb.KernelApcDisable;
        LODWORD(pRestrictedSidsLength) = 0;
        PackageSidLength = 0i64;
        HIDWORD(pPrivilegeCount) = 0;
        LODWORD(TrustSidLength) = 0;
        LODWORD(SecurityAttributesLength) = 0;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        TokenAccessInformationBufferSize = SepGetTokenAccessInformationBufferSize(
                                             (_TOKEN *)AccessToken,
                                             0,
                                             0i64,
                                             &pPrivilegeCount,
                                             (UINT64 *)((char *)&pGroupsLength + 4),
                                             &pGroupsLength,
                                             (UINT64 *)((char *)&pRestrictedSidsLength + 4),
                                             &pRestrictedSidsLength,
                                             (UINT64 *)((char *)&PackageSidLength + 4),
                                             &PackageSidLength,
                                             (UINT64 *)((char *)&pPrivilegeCount + 4),
                                             &TrustSidLength,
                                             &SecurityAttributesLength);
        v53 = (_TOKEN_ACCESS_INFORMATION *)ExAllocatePoolWithTag(1ui64, TokenAccessInformationBufferSize, 538994003i64);
        v13 = v53;
        if( !v53 )
          goto LABEL_70;
        LODWORD(pSecurityAttributesLength) = SecurityAttributesLength;
        LODWORD(pTrustSidLength) = TrustSidLength;
        LODWORD(pCapabilitySidsSALength) = HIDWORD(pPrivilegeCount);
        LODWORD(pPackageSidLength) = HIDWORD(PackageSidLength);
        LODWORD(pCapabilitySidsLength) = PackageSidLength;
        LODWORD(RemainingTargetSidBufferSize) = HIDWORD(pRestrictedSidsLength);
        LODWORD(pRestrictedSidsSALength) = pRestrictedSidsLength;
        LODWORD(TargetSid) = HIDWORD(pGroupsLength);
        LODWORD(NextTargetSida) = pGroupsLength;
        SepCopyTokenAccessInformation(
          (_TOKEN *)AccessToken,
          v53,
          TokenAccessInformationBufferSize,
          (unsigned int)pPrivilegeCount,
          (UINT64)TargetSid,
          (UINT64)NextTargetSida,
          (UINT64)RemainingTargetSidBufferSize,
          (UINT64)pRestrictedSidsSALength,
          (UINT64)pPackageSidLength,
          (UINT64)pCapabilitySidsLength,
          (UINT64)pCapabilitySidsSALength,
          (UINT64)pTrustSidLength,
          (UINT64)pSecurityAttributesLength,
          0,
          0i64);
        goto LABEL_10;
      case TokenIntegrityLevel:
        v23 = (_ETHREAD *)KeGetCurrentThread();
        IntegritySA = 0i64;
        --v23->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        SepCopyTokenIntegrity((_TOKEN *)AccessToken, &IntegritySA);
        Sid = IntegritySA.Sid;
        LODWORD(v25) = RtlSubAuthorityCountSid((INT64)IntegritySA.Sid);
        v26 = *v25;
        if( (_BYTE)v26 )
        {
          LODWORD(v27) = RtlSubAuthoritySid((INT64)Sid, (unsigned int)(v26 - 1));
          LODWORD(v3) = *v27;
        }
        *(_DWORD *)TokenInformation = (_DWORD)v3;
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        return 0;
      case TokenCapabilities:
        v38 = (_ETHREAD *)KeGetCurrentThread();
        --v38->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v39 = *((_DWORD *)AccessToken + 200);
        v40 = 16 * v39 + 24;
        v41 = v40;
        if( v39 )
        {
          v42 = (__int64 *)*((_QWORD *)AccessToken + 99);
          v43 = v39;
          do
          {
            v44 = *v42;
            v42 += 2;
            v40 += 4 * *(unsigned __int8 *)(v44 + 1) + 8;
            v41 = v40;
            --v43;
          }
          while( v43 );
        }
        v45 = ExAllocatePoolWithTag(1ui64, v41, 538994003i64);
        v37 = v45;
        if( !v45 )
          goto LABEL_70;
        *(_DWORD *)v45 = *((_DWORD *)AccessToken + 200);
        RtlCopySidAndAttributesArray(
          *((unsigned int *)AccessToken + 200),
          *((_SID_AND_ATTRIBUTES **)AccessToken + 99),
          v40,
          (_SID_AND_ATTRIBUTES *)(v45 + 1),
          (char *)v45 + (unsigned int)(16 * *((_DWORD *)AccessToken + 200)) + 24,
          (VOID **)&RemainingTargetSufferSize,
          &RemainingTargetSufferSize);
        goto LABEL_39;
      case TokenAppContainerSid:
        v33 = (_ETHREAD *)KeGetCurrentThread();
        --v33->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v34 = (VOID **)*((_QWORD *)AccessToken + 98);
        if( v34 )
          v35 = 4 * *((unsigned __int8 *)v34 + 1) + 16;
        else
          v35 = 8;
        v36 = ExAllocatePoolWithTag(1ui64, v35, 538994003i64);
        v37 = v36;
        if( !v36 )
          goto LABEL_70;
        if( !v34 )
          goto LABEL_38;
        v46 = (VOID *)*((_QWORD *)AccessToken + 98);
        goto LABEL_51;
      case TokenAppContainerNumber:
        v14 = (_ETHREAD *)KeGetCurrentThread();
        --v14->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v15 = *((_QWORD *)AccessToken + 135);
        if( v15 )
          LODWORD(v3) = *(_DWORD *)(v15 + 40);
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *(_DWORD *)TokenInformation = (_DWORD)v3;
        return 0;
      case TokenUserClaimAttributes:
      case TokenDeviceClaimAttributes:
        *TokenInformation = 0i64;
        v99 = (_ETHREAD *)KeGetCurrentThread();
        --v99->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v100 = *((_QWORD *)AccessToken + 137);
        if( v100
          && ((v101 = *(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)(v100 + 576)) != 0i64
           || TokenInformationClass != TokenUserClaimAttributes)
          && ((v102 = *(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)(v100 + 584)) != 0i64
           || TokenInformationClass != TokenDeviceClaimAttributes) )
        {
          if( TokenInformationClass == TokenUserClaimAttributes )
            v102 = v101;
          AuthzBasepQueryClaimAttributesToken(v102, 0i64, 0i64, &pReturnLength);
          v103 = pReturnLength;
        }
        else
        {
          DWORD2(v136) = 0;
          *(_QWORD *)&v136 = (char *)&v135 + 8;
          v102 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)&v135;
          v103 = 16;
          *((_QWORD *)&v135 + 1) = (char *)&v135 + 8;
          *((_QWORD *)&v137 + 1) = &v137;
          *(_QWORD *)&v137 = &v137;
        }
        v104 = ExAllocatePoolWithTag(1ui64, v103, 538994003i64);
        v105 = v104;
        if( !v104 )
          goto LABEL_70;
        v106 = AuthzBasepQueryClaimAttributesToken(v102, v104, v103, &pReturnLength);
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        if( v106 >= 0 )
          *TokenInformation = v105;
        else
          ExFreePoolWithTag(v105, 0);
        return v106;
      case TokenDeviceGroups:
        v107 = (_ETHREAD *)KeGetCurrentThread();
        --v107->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v108 = (unsigned int *)*((_QWORD *)AccessToken + 137);
        if( v108 && (v109 = *v108) != 0 )
        {
          v110 = 16 * v109 + 8;
        }
        else
        {
          v109 = 0;
          v110 = 24;
        }
        v111 = v110;
        if( v109 )
        {
          v112 = (__int64 *)*((_QWORD *)v108 + 1);
          v113 = v109;
          do
          {
            v114 = *v112;
            v112 += 2;
            v110 += 4 * *(unsigned __int8 *)(v114 + 1) + 8;
            v111 = v110;
            --v113;
          }
          while( v113 );
        }
        v115 = ExAllocatePoolWithTag(1ui64, v111, 538994003i64);
        if( !v115 )
          goto LABEL_70;
        *(_OWORD *)v115 = 0i64;
        v115[2] = 0i64;
        *(_DWORD *)v115 = v109;
        if( v109 )
          RtlCopySidAndAttributesArray(
            **((unsigned int **)AccessToken + 137),
            *(_SID_AND_ATTRIBUTES **)(*((_QWORD *)AccessToken + 137) + 8i64),
            v110,
            (_SID_AND_ATTRIBUTES *)(v115 + 1),
            &v115[2 * v109 + 1],
            (VOID **)&RemainingTargetSufferSize,
            &RemainingTargetSufferSize);
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *TokenInformation = v115;
        return 0;
      case TokenProcessTrustLevel:
        v116 = (_ETHREAD *)KeGetCurrentThread();
        --v116->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v34 = (VOID **)*((_QWORD *)AccessToken + 138);
        if( v34 )
          v35 = 4 * *((unsigned __int8 *)v34 + 1) + 16;
        else
          v35 = 8;
        v36 = ExAllocatePoolWithTag(1ui64, v35, 538994003i64);
        v37 = v36;
        if( !v36 )
          goto LABEL_70;
        if( !v34 )
          goto LABEL_38;
        v46 = (VOID *)*((_QWORD *)AccessToken + 138);
LABEL_51:
        v34 = v36 + 1;
        RtlCopySid(v35 - 8, v36 + 1, v46);
LABEL_38:
        *v37 = v34;
LABEL_39:
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *TokenInformation = v37;
        return 0;
      case MaxTokenInfoClass:
        v117 = (_ETHREAD *)KeGetCurrentThread();
        --v117->Tcb.KernelApcDisable;
        ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
        v118 = *((_QWORD *)AccessToken + 144);
        v119 = 16i64;
        if( v118 )
          v119 = *(unsigned __int16 *)(v118 + 42) + 16i64;
        v95 = ExAllocatePoolWithTag(1ui64, v119, 538994003i64);
        v13 = v95;
        if( !v95 )
        {
LABEL_70:
          ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
          KeLeaveCriticalRegion();
          return -1073741670;
        }
        if( *((_QWORD *)AccessToken + 144) )
        {
          *((_BYTE *)v95 + 8) = 1;
          *v95 = v95 + 2;
          memmove(
            v95 + 2,
            *(const VOID **)(*((_QWORD *)AccessToken + 144) + 48i64),
            *(unsigned __int16 *)(*((_QWORD *)AccessToken + 144) + 42i64));
        }
        else
        {
          *((_BYTE *)v95 + 8) = 0;
LABEL_137:
          *v95 = 0i64;
        }
LABEL_10:
        ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
        KeLeaveCriticalRegion();
        *TokenInformation = v13;
        break;
      case MaxTokenInfoClass|TokenGroups:
        v47 = (*((_DWORD *)AccessToken + 50) & 0x4000) != 0 && !SepCanTokenMatchAllPackageSid((_TOKEN *)AccessToken);
        *(_DWORD *)TokenInformation = v47;
        return 0;
      case TokenAppContainerNumber|TokenAuditPolicy:
        LODWORD(NextTargetSid) = 0;
        wil_details_FeatureReporting_ReportUsageToService(
          (wil_details_FeatureReportingCache *)&stru_140CF2E80 + 823,
          0x126C519ui64,
          0i64,
          0i64,
          (FEATURE_LOGGED_TRAITS *)&Feature_PPLEnforcement_logged_traits,
          (INT64)NextTargetSid);
        return -1073741821;
      default:
        return -1073741821;
    }
  }
  return 0;
}

Referenced by: