PspInitializeProcessSecurity

NTSTATUS __stdcall PspInitializeProcessSecurity(
        _EPROCESS *ParentProcess,
        _EPROCESS *Child,
        VOID *TokenObject,
        UINT64 ExplicitToken,
        UINT64 ChildProcessPolicy,
        UINT64 IsSnapshotProcess,
        UINT64 AllApplicationPackagesPolicy,
        VOID *OriginClaimData,
        UINT64 OriginClaimDataSize,
        PSP_ALLOCATE_PROCESS_STATE *AllocateProcessState){
  __int64 v10; 
  int v12; 
  int *v13; 
  VOID *v16; 
  int SessionId; 
  int v18; 
  NTSTATUS v19; 
  int v20; 
  signed __int64 SecurityDomain; 
  UINT64 AllApplicationPackagesPolicya; 
  UINT64 OriginClaimDataSizea; 
  VOID *Object; 
  _DWORD v26[4]; 
  _EPROCESS *v27; 
  __int64 v28; 
  __int16 v29; 
  char v30; 
  INT64 v31; 
  int v32; 
  __int64 v33; 
  __int64 v34; 

  v10 = v34;
  v29 = 0;
  v30 = 0;
  Object = 0i64;
  v12 = ExplicitToken;
  *(_DWORD *)v34 = 0;
  v13 = (int *)(v10 + 4);
  *(_DWORD *)(v10 + 4) = 0;
  v16 = 0i64;
  if( ParentProcess )
  {
    v26[0] = ChildProcessPolicy;
    v26[1] = v32;
    v26[2] = IsSnapshotProcess;
    v26[3] = AllApplicationPackagesPolicy;
    v28 = v33;
    v27 = ParentProcess;
    SessionId = MmGetSessionId(Child);
    LODWORD(OriginClaimDataSizea) = (_DWORD)AllocateProcessState;
    LODWORD(AllApplicationPackagesPolicya) = (_DWORD)OriginClaimData;
    v19 = SeSubProcessToken(
            Child,
            TokenObject,
            (INT64 *)&Object,
            v18 != 0 ? 1 : 3,
            SessionId,
            (__int64)v26,
            AllApplicationPackagesPolicya,
            OriginClaimDataSize,
            OriginClaimDataSizea,
            v31,
            (__int64)&v29);
    if( v19 >= 0 )
    {
      ObInitializeFastReference(&Child->Token, Object);
      if( v12 || (_BYTE)v29 )
        *(_DWORD *)v10 = 1;
      if( HIBYTE(v29) )
      {
        *v13 = 1;
        v20 = 1;
      }
      else
      {
        v20 = *v13;
      }
      if( !v20 && v30 )
      {
        v16 = PsReferencePrimaryToken(ParentProcess);
        v19 = PspIdentityBasedJobBreakaway(v16, Object, (UINT64 *)(v10 + 4));
      }
    }
    if( *(_DWORD *)v10
      || (ParentProcess->MitigationFlags & 0x80000000) != 0
      || (Child->Flags3 & 0x800000) != 0 && !ParentProcess->SecurityDomain )
    {
      SecurityDomain = _InterlockedIncrement64(&PsNextSecurityDomain);
    }
    else
    {
      SecurityDomain = ParentProcess->SecurityDomain;
    }
    Child->SecurityDomain = SecurityDomain;
    Child->ParentSecurityDomain = SecurityDomain;
  }
  else
  {
    ObInitializeFastReference(&Child->Token, 0i64);
    SeAssignPrimaryToken(Child, TokenObject);
    v19 = 0;
  }
  if( v16 )
    ObFastDereferenceObject(&ParentProcess->Token, v16);
  return v19;
}

Referenced by: