SepCopyTokenAccessInformation

VOID __stdcall SepCopyTokenAccessInformation(
        _TOKEN *Token,
        _TOKEN_ACCESS_INFORMATION *pTAI,
        UINT64 TAIBufferLength,
        UINT64 PrivilegeCount,
        UINT64 GroupsLength,
        UINT64 GroupsSALength,
        UINT64 RestrictedSidsLength,
        UINT64 RestrictedSidsSALength,
        UINT64 PackageSidLength,
        UINT64 CapabilitySidsLength,
        UINT64 CapabilitySidsSALength,
        UINT64 TrustSidLength,
        UINT64 SecurityAttributesLength,
        UINT8 UseNewTrust,
        VOID *NewTrustSid){
  unsigned int v16; 
  int v18; 
  __int64 v19; 
  __int64 v20; 
  char *v21; 
  unsigned int v22; 
  UINT64 v23; 
  char *TargetSid; 
  _SID_AND_ATTRIBUTES *v25; 
  char *v26; 
  UINT64 RestrictedSidCount; 
  char *v28; 
  char *v29; 
  UINT64 CapabilityCount; 
  char *v31; 
  void *v32; 
  unsigned __int8 *TrustLevelSid; 
  char *v34; 
  char *v35; 
  _TOKEN_PRIVILEGES *v36; 
  UINT64 pReturnSize; 

  pTAI->AuthenticationId = Token->AuthenticationId;
  v16 = PrivilegeCount;
  pTAI->TokenType = Token->TokenType;
  pTAI->ImpersonationLevel = Token->ImpersonationLevel;
  pTAI->Flags = Token->TokenFlags;
  v18 = (_DWORD)pTAI + TAIBufferLength;
  SeQueryMandatoryPolicyToken(Token, &pTAI->MandatoryPolicy);
  v20 = *(_QWORD *)(v19 + 1080);
  v21 = 0i64;
  v22 = 0;
  if( v20 )
    v22 = *(_DWORD *)(v20 + 40);
  v23 = (unsigned int)(GroupsLength - GroupsSALength);
  pTAI->AppContainerNumber = v22;
  LODWORD(pTAI[1].SidHash) = Token->UserAndGroupCount;
  TargetSid = (char *)&pTAI[4].RestrictedSidHash + (unsigned int)GroupsSALength;
  pTAI[1].RestrictedSidHash = (_SID_AND_ATTRIBUTES_HASH *)&pTAI[4].RestrictedSidHash;
  pTAI->SidHash = (_SID_AND_ATTRIBUTES_HASH *)&pTAI[1];
  RtlCopySidAndAttributesArray(
    Token->UserAndGroupCount,
    Token->UserAndGroups,
    v23,
    (_SID_AND_ATTRIBUTES *)&pTAI[4].RestrictedSidHash,
    TargetSid,
    (VOID **)&pReturnSize,
    &pReturnSize);
  RtlSidHashInitialize(
    (_SID_AND_ATTRIBUTES *)&pTAI[4].RestrictedSidHash,
    Token->UserAndGroupCount,
    (_SID_AND_ATTRIBUTES_HASH *)&pTAI[1]);
  v25 = (_SID_AND_ATTRIBUTES *)((char *)&pTAI[4].RestrictedSidHash + (unsigned int)GroupsLength);
  LODWORD(v25->Sid) = Token->RestrictedSidCount;
  v26 = (char *)&v25[17];
  *(_QWORD *)&v25->Attributes = v25 + 17;
  pTAI->RestrictedSidHash = (_SID_AND_ATTRIBUTES_HASH *)v25;
  RestrictedSidCount = Token->RestrictedSidCount;
  if( (_DWORD)RestrictedSidCount )
  {
    RtlCopySidAndAttributesArray(
      RestrictedSidCount,
      Token->RestrictedSids,
      (unsigned int)(RestrictedSidsLength - RestrictedSidsSALength),
      v25 + 17,
      &v26[(unsigned int)RestrictedSidsSALength],
      (VOID **)&pReturnSize,
      &pReturnSize);
    RtlSidHashInitialize(v25 + 17, Token->RestrictedSidCount, (_SID_AND_ATTRIBUTES_HASH *)v25);
  }
  v28 = &v26[(unsigned int)RestrictedSidsLength];
  *(_DWORD *)v28 = Token->CapabilityCount;
  v29 = v28 + 272;
  *((_QWORD *)v28 + 1) = v28 + 272;
  pTAI->CapabilitiesHash = (_SID_AND_ATTRIBUTES_HASH *)v28;
  CapabilityCount = Token->CapabilityCount;
  if( (_DWORD)CapabilityCount )
  {
    RtlCopySidAndAttributesArray(
      CapabilityCount,
      Token->Capabilities,
      (unsigned int)(CapabilitySidsLength - CapabilitySidsSALength),
      (_SID_AND_ATTRIBUTES *)v28 + 17,
      &v29[(unsigned int)CapabilitySidsSALength],
      (VOID **)&pReturnSize,
      &pReturnSize);
    RtlSidHashInitialize((_SID_AND_ATTRIBUTES *)v28 + 17, Token->CapabilityCount, (_SID_AND_ATTRIBUTES_HASH *)v28);
  }
  v31 = &v29[(unsigned int)CapabilitySidsLength];
  v32 = 0i64;
  if( (_DWORD)PackageSidLength )
  {
    v32 = v31;
    memmove(v31, Token->Package, 4 * *((unsigned __int8 *)Token->Package + 1) + 8);
  }
  TrustLevelSid = (unsigned __int8 *)NewTrustSid;
  pTAI->PackageSid = v32;
  if( !UseNewTrust )
    TrustLevelSid = (unsigned __int8 *)Token->TrustLevelSid;
  v34 = &v31[(unsigned int)PackageSidLength];
  if( (_DWORD)TrustSidLength )
  {
    v21 = v34;
    memmove(v34, TrustLevelSid, 4 * TrustLevelSid[1] + 8);
  }
  v35 = &v34[(unsigned int)TrustSidLength];
  pTAI->TrustLevelSid = v21;
  AuthzBasepQueryInternalSecurityAttributesToken(
    Token->pSecurityAttributes,
    v35,
    (unsigned int)(v18 - (_DWORD)v35),
    &pReturnSize);
  v36 = (_TOKEN_PRIVILEGES *)&v35[(unsigned int)SecurityAttributesLength];
  pTAI->SecurityAttributes = v35;
  v36->PrivilegeCount = v16;
  pTAI->Privileges = v36;
  SepConvertTokenPrivilegesToLuidAndAttributes(Token, v36->Privileges);
}

Referenced by: