SepRemoveDisabledGroupsAndPrivileges

UINT8 __stdcall SepRemoveDisabledGroupsAndPrivileges(
        _TOKEN *Token,
        UINT64 Flags,
        UINT64 GroupCount,
        _SID_AND_ATTRIBUTES *GroupsToDisable,
        UINT64 PrivilegeCount,
        _LUID_AND_ATTRIBUTES *PrivilegesToDelete){
  unsigned int v6; 
  char v7; 
  UINT8 v8; 
  unsigned int v9; 
  char v11; 
  _SID_AND_ATTRIBUTES *UserAndGroups; 
  UINT8 v14; 
  unsigned __int64 v15; 
  unsigned int v16; 
  __int64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  __int64 v21; 
  unsigned __int64 Present; 
  unsigned int v23; 
  int v24; 
  unsigned int v25; 
  unsigned int v26; 

  v26 = GroupCount;
  v6 = 0;
  v7 = 0;
  v8 = 0;
  v9 = 0;
  v11 = Flags;
  if( Token->UserAndGroupCount )
  {
    while( 1 )
    {
      UserAndGroups = Token->UserAndGroups;
      v14 = 0;
      v15 = v9;
      if( (UserAndGroups[v15].Attributes & 0x30) == 0 )
        v14 = SepSidInSidAndAttributes(
                GroupsToDisable,
                (unsigned int)GroupCount,
                (VOID *)GroupCount,
                UserAndGroups[v15].Sid);
      if( v14 )
        goto LABEL_14;
      if( (v11 & 4) != 0 && RtlIsElevatedRid((INT64)&Token->UserAndGroups[v15]) )
        break;
LABEL_6:
      GroupCount = v26;
      if( ++v9 >= Token->UserAndGroupCount )
      {
        v6 = 0;
        goto LABEL_8;
      }
    }
    v7 = 1;
LABEL_14:
    v18 = v9;
    v8 = 1;
    Token->UserAndGroups[v18].Attributes &= 0xFFFFFFF0;
    Token->UserAndGroups[v18].Attributes |= 0x10u;
    Token->TokenFlags |= 0x800u;
    if( v9 == Token->DefaultOwnerIndex )
      Token->DefaultOwnerIndex = 0;
    goto LABEL_6;
  }
LABEL_8:
  v16 = Token->TokenFlags & 0x800;
  if( !v16 )
  {
    SepTokenPrivilegeCount(Token, Flags);
    v6 = v23;
  }
  if( (v11 & 1) != 0 )
  {
    v8 = 1;
    Token->Privileges.Enabled &= 0x800000ui64;
    Token->Privileges.EnabledByDefault &= 0x800000ui64;
    Token->Privileges.Present &= 0x800000ui64;
  }
  else
  {
    if( (v11 & 4) != 0 )
    {
      v8 = 1;
      v19 = 0x602880000i64;
      if( !v7 )
        v19 = 0xFFFFFFEEDFE9F97Bui64;
      v20 = v19 & Token->Privileges.Enabled;
      Flags = v19 & Token->Privileges.Present;
      Token->Privileges.EnabledByDefault &= v19;
      Token->Privileges.Present = Flags;
      Token->Privileges.Enabled = v20;
    }
    if( (_DWORD)PrivilegeCount )
    {
      Flags = (UINT64)PrivilegesToDelete;
      v21 = (unsigned int)PrivilegeCount;
      do
      {
        if( (unsigned int)(*(_DWORD *)Flags - 2) <= 0x22 )
        {
          Token->Privileges.Enabled &= ~(1i64 << *(_DWORD *)Flags);
          Present = Token->Privileges.Present;
          _bittestandreset64((__int64 *)&Present, *(unsigned int *)Flags);
          Token->Privileges.Present = Present;
        }
        Flags += 12i64;
        --v21;
      }
      while( v21 );
    }
  }
  if( !v16 )
  {
    SepTokenPrivilegeCount(Token, Flags);
    if( v25 < v6 )
      Token->TokenFlags = v24 | 0x800;
  }
  return v8;
}

Referenced by: