SeFilterToken

NTSTATUS __stdcall SeFilterToken(
        VOID *ExistingToken,
        UINT64 Flags,
        _TOKEN_GROUPS *SidsToDisable,
        _TOKEN_PRIVILEGES *PrivilegesToDelete,
        _TOKEN_GROUPS *RestrictedSids,
        VOID **NewToken){
  VOID **v6; 
  ULONG GroupCount; 
  ULONG v8; 
  _SID_AND_ATTRIBUTES *Groups; 
  unsigned int v10; 
  int inserted; 
  ULONG v14; 
  unsigned int *p_Attributes; 
  _SID_AND_ATTRIBUTES *GroupsToDisable; 
  UINT64 PrivilegeCount; 
  UINT64 SidCount; 
  UINT64 v19; 
  PVOID Object; 

  v6 = NewToken;
  GroupCount = 0;
  Object = 0i64;
  v8 = 0;
  Groups = 0i64;
  v10 = 0;
  *NewToken = 0i64;
  if( SidsToDisable )
    GroupCount = SidsToDisable->GroupCount;
  if( PrivilegesToDelete )
    v10 = PrivilegesToDelete->PrivilegeCount;
  if( RestrictedSids
    && (v8 = RestrictedSids->GroupCount, Groups = RestrictedSids->Groups, v14 = 0, RestrictedSids->GroupCount) )
  {
    p_Attributes = &RestrictedSids->Groups[0].Attributes;
    while( !*p_Attributes )
    {
      ++v14;
      p_Attributes += 4;
      if( v14 >= v8 )
        goto LABEL_6;
    }
    return -1073741811;
  }
  else
  {
LABEL_6:
    LODWORD(v19) = 0;
    LODWORD(SidCount) = v8;
    LODWORD(PrivilegeCount) = v10;
    inserted = SepFilterToken(
                 ExistingToken,
                 0,
                 (unsigned int)Flags,
                 GroupCount,
                 (_SID_AND_ATTRIBUTES *)((unsigned __int64)SidsToDisable->Groups & -(__int64)(SidsToDisable != 0i64)),
                 PrivilegeCount,
                 (_LUID_AND_ATTRIBUTES *)((unsigned __int64)PrivilegesToDelete->Privileges & -(__int64)(PrivilegesToDelete != 0i64)),
                 SidCount,
                 Groups,
                 v19,
                 (_TOKEN **)&Object);
    if( inserted >= 0 )
    {
      LODWORD(GroupsToDisable) = 0;
      inserted = ObInsertObjectEx(Object, 0i64, 0i64, 0i64, (UINT64)GroupsToDisable, 0i64, 0i64);
      if( inserted >= 0 )
      {
        SepAppendAceToTokenObjectAcl(Object, 8ui64, SeAliasAdminsSid);
        *v6 = Object;
      }
    }
    return inserted;
  }
}

Referenced by: