NtDuplicateToken

NTSTATUS __fastcall NtDuplicateToken(UINT64 a1, INT64 a2, INT64 a3, INT8 a4, INT64 TokenType, UINT64 NewTokenHandle){
  unsigned int v7; 
  char PreviousMode; 
  _QWORD *v10; 
  _TOKEN_TYPE v11; 
  NTSTATUS result; 
  unsigned int GrantedAccess; 
  _ADAPTER_OBJECT *v14; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; 
  int inserted; 
  UINT64 v17; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v19; 
  PVOID *Object; 
  UINT8 NewTokenAsRestrictedAsProcessToken; 
  UINT8 SecurityQosPresent; 
  char SecurityDescriptorPresent[6]; 
  PVOID NewToken; 
  PVOID Token; 
  _OBJECT_HANDLE_INFORMATION HandleInformation; 
  PVOID Handle; 
  _SECURITY_QUALITY_OF_SERVICE CapturedSecurityQos; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _KNOWN_CONTROLLER_TYPE v30[4]; 
  __int128 v31; 

  v7 = a2;
  *(_QWORD *)&CapturedSecurityQos.Length = 0i64;
  *(_DWORD *)&CapturedSecurityQos.ContextTrackingMode = 0;
  SecurityQosPresent = 0;
  SecurityDescriptorPresent[0] = 0;
  Handle = 0i64;
  HandleInformation = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  NewTokenAsRestrictedAsProcessToken = 0;
  *(_OWORD *)v30 = 0i64;
  v31 = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v11 = (int)TokenType;
    if( (unsigned int)(TokenType - 1) > 1 )
      return -1073741811;
    v10 = (_QWORD *)NewTokenHandle;
    v17 = NewTokenHandle;
    if( NewTokenHandle >= 0x7FFFFFFF0000i64 )
      v17 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v17 = *(_QWORD *)v17;
  }
  else
  {
    v10 = (_QWORD *)NewTokenHandle;
    v11 = (int)TokenType;
  }
  result = SeCaptureSecurityQos((_OBJECT_ATTRIBUTES *)a3, PreviousMode, &SecurityQosPresent, &CapturedSecurityQos);
  if( result >= 0 )
  {
    result = SeCaptureObjectAttributeSecurityDescriptorPresent(
               (_OBJECT_ATTRIBUTES *)a3,
               PreviousMode,
               (UINT8 *)SecurityDescriptorPresent);
    if( result >= 0 )
    {
      NewToken = 0i64;
      result = ObReferenceObjectByHandle(
                 (VOID *)a1,
                 2ui64,
                 (_OBJECT_TYPE *)SeTokenObjectType,
                 PreviousMode,
                 &NewToken,
                 &HandleInformation);
      if( result >= 0 )
      {
        if( v7 )
        {
          SeCaptureSubjectContextEx(
            (PETHREAD)KeGetCurrentThread(),
            KeGetCurrentThread()->ApcState.Process,
            &SubjectContext);
          *(_QWORD *)&v31 = SubjectContext.PrimaryToken;
          if( (unsigned __int8)RtlIsSandboxedToken((_KNOWN_CONTROLLER_TYPE)&SubjectContext)
            && (unsigned __int8)RtlIsSandboxedToken((_KNOWN_CONTROLLER_TYPE)v30) )
          {
            CurrentThread = (_ETHREAD *)KeGetCurrentThread();
            --CurrentThread->Tcb.KernelApcDisable;
            ExAcquireResourceSharedLite(*((_QWORD *)SubjectContext.PrimaryToken + 6), 1);
            v19 = SepNewTokenAsRestrictedAsProcessToken(
                    NewToken,
                    SubjectContext.PrimaryToken,
                    &NewTokenAsRestrictedAsProcessToken);
            if( NewToken == SubjectContext.PrimaryToken || v19 >= 0 && NewTokenAsRestrictedAsProcessToken )
              GrantedAccess = v7;
            else
              GrantedAccess = v7 & (HandleInformation.GrantedAccess | 0x2001F);
            ExReleaseResourceLite(*((PERESOURCE *)SubjectContext.PrimaryToken + 6));
            KeLeaveCriticalRegionThread(KeGetCurrentThread());
          }
          else
          {
            GrantedAccess = v7;
          }
          SeReleaseSubjectContext(&SubjectContext);
        }
        else
        {
          GrantedAccess = HandleInformation.GrantedAccess;
        }
        v14 = (_ADAPTER_OBJECT *)NewToken;
        if( SecurityQosPresent )
          ImpersonationLevel = CapturedSecurityQos.ImpersonationLevel;
        else
          ImpersonationLevel = *((_DWORD *)NewToken + 49);
        if( *((_DWORD *)NewToken + 48) == 2
          && (v11 == TokenImpersonation && ImpersonationLevel > *((_DWORD *)NewToken + 49)
           || v11 == TokenPrimary && *((int *)NewToken + 49) < 2) )
        {
          HalPutDmaAdapter((PADAPTER_OBJECT)NewToken);
          return -1073741659;
        }
        else
        {
          Token = 0i64;
          inserted = SepDuplicateToken(
                       (_TOKEN *)NewToken,
                       (_OBJECT_ATTRIBUTES *)a3,
                       a4,
                       v11,
                       ImpersonationLevel,
                       PreviousMode,
                       0,
                       (_TOKEN **)&Token);
          if( inserted >= 0 )
          {
            LODWORD(Object) = 0;
            inserted = ObInsertObjectEx(Token, 0i64, GrantedAccess, 1ui64, (UINT64)Object, 0i64, &Handle);
            if( inserted >= 0 )
            {
              if( !SecurityDescriptorPresent[0] )
                SepAppendAceToTokenObjectAcl(Token, 8ui64, SeAliasAdminsSid);
              HalPutDmaAdapter((PADAPTER_OBJECT)Token);
            }
          }
          HalPutDmaAdapter(v14);
          if( inserted >= 0 )
            *v10 = Handle;
          return inserted;
        }
      }
    }
  }
  return result;
}

Referenced by: