RtlAcquirePrivilege

NTSTATUS __stdcall RtlAcquirePrivilege(UINT64 *Privilege, UINT64 NumPriv, UINT64 Flags, VOID **ReturnedState){
  __int64 v5; 
  char v7; 
  char *PoolWithQuotaTag; 
  INT64 v9; 
  UINT64 v10; 
  VOID **v11; 
  int v12; 
  __int64 v13; 
  __int64 v14; 
  unsigned int v15; 
  __int64 v16; 
  void *v18; 
  VOID *v19; 
  _TOKEN_PRIVILEGES *PreviousState; 
  INT64 v21; 
  INT64 ThreadInformation[2]; 
  UINT64 BufferLength; 

  LODWORD(BufferLength) = 0;
  v5 = (unsigned int)NumPriv;
  if( (Flags & 0xFFFFFFFC) != 0 )
    return -1073741811;
  v7 = Flags | 1;
  if( (Flags & 2) == 0 )
    v7 = Flags;
  PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag(
                               (POOL_TYPE)520,
                               12 * ((unsigned int)(NumPriv - 1) + 90i64),
                               0x62507452ui64);
  v10 = (UINT64)PoolWithQuotaTag;
  if( PoolWithQuotaTag )
  {
    *(_QWORD *)PoolWithQuotaTag = 0i64;
    v11 = (VOID **)(PoolWithQuotaTag + 8);
    *((_QWORD *)PoolWithQuotaTag + 1) = 0i64;
    *((_DWORD *)PoolWithQuotaTag + 8) = 0;
    if( (*(_DWORD *)&KeGetCurrentThread()[1].gapD8[8] & 8) == 0 )
      goto LABEL_9;
    if( (v7 & 1) != 0 )
    {
      v12 = RtlpOpenThreadToken(4ui64, v11);
      if( v12 >= 0 )
      {
        *(_DWORD *)(v10 + 32) |= 1u;
        ThreadInformation[0] = 0i64;
        ZwSetInformationThread(0xFFFFFFFFFFFFFFFEui64, 5i64, (UINT64)ThreadInformation, 8ui64);
        goto LABEL_9;
      }
    }
    else
    {
      v12 = RtlpOpenThreadToken(0x28ui64, (VOID **)PoolWithQuotaTag);
      if( v12 >= 0 )
      {
LABEL_9:
        if( *(_QWORD *)v10 )
          goto LABEL_13;
        if( (v7 & 2) != 0 )
        {
          v12 = ZwOpenProcessTokenEx(0xFFFFFFFFFFFFFFFFui64, 40i64, 512i64, v10);
          if( v12 >= 0 )
          {
            *(_DWORD *)(v10 + 32) |= 2u;
LABEL_13:
            *(_QWORD *)(v10 + 24) = v10 + 1064;
            *(_QWORD *)(v10 + 16) = v10 + 36;
            *(_DWORD *)(v10 + 1064) = v5;
            if( (_DWORD)v5 )
            {
              v13 = 0i64;
              v14 = v5;
              do
              {
                v15 = *(_DWORD *)Privilege;
                v13 += 12i64;
                v16 = *(_QWORD *)(v10 + 24);
                Privilege = (UINT64 *)((char *)Privilege + 4);
                ThreadInformation[0] = v15;
                *(_QWORD *)(v13 + v16 - 8) = v15;
                *(_DWORD *)(v13 + *(_QWORD *)(v10 + 24)) = 2;
                --v14;
              }
              while( v14 );
            }
            LODWORD(BufferLength) = 1024;
            v12 = ZwAdjustPrivilegesToken(
                    *(_QWORD *)v10,
                    0,
                    *(_QWORD *)(v10 + 24),
                    1024i64,
                    *(_QWORD *)(v10 + 16),
                    &BufferLength);
            if( v12 == -1073741789 )
            {
              while( 1 )
              {
                v19 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, (unsigned int)BufferLength, 0x62507452ui64);
                *(_QWORD *)(v10 + 16) = v19;
                if( !v19 )
                  break;
                v12 = ZwAdjustPrivilegesToken(
                        *(_QWORD *)v10,
                        0,
                        *(_QWORD *)(v10 + 24),
                        (unsigned int)BufferLength,
                        (UINT64)v19,
                        &BufferLength);
                if( v12 != -1073741789 )
                  goto LABEL_17;
                ExFreePoolWithTag(*(PVOID *)(v10 + 16), 0);
              }
              v12 = -1073741801;
            }
LABEL_17:
            if( v12 == 262 )
            {
              if( (_DWORD)v5 == 1 )
              {
                v12 = -1073741727;
LABEL_22:
                v18 = *(void **)(v10 + 16);
                if( v18 && v18 != (void *)(v10 + 36) )
                  ExFreePoolWithTag(v18, 0);
                ZwClose(*(_QWORD *)v10);
                goto LABEL_26;
              }
              v12 = 0;
            }
            if( v12 >= 0 )
            {
              *ReturnedState = (VOID *)v10;
              return 0;
            }
            goto LABEL_22;
          }
        }
        else
        {
          v12 = RtlImpersonateSelfEx(
                  SecurityDelegation,
                  0x28ui64,
                  (VOID **)v10,
                  v9,
                  (INT64)PreviousState,
                  v21,
                  ThreadInformation[0],
                  ThreadInformation[1]);
          if( v12 >= 0 )
          {
            *(_DWORD *)(v10 + 32) |= 1u;
            goto LABEL_13;
          }
        }
LABEL_26:
        if( (*(_DWORD *)(v10 + 32) & 1) != 0 )
        {
          ZwSetInformationThread(0xFFFFFFFFFFFFFFFEui64, 5i64, (UINT64)v11, 8ui64);
          if( *v11 )
            ZwClose((_HANDLE)*v11);
        }
      }
    }
    ExFreePoolWithTag((PVOID)v10, 0);
    return v12;
  }
  return -1073741801;
}

Referenced by: