SeQueryUserSidToken

NTSTATUS __stdcall SeQueryUserSidToken(VOID *AccessToken, VOID *UserSid, UINT64 Length, UINT64 *RequiredLength){
  _ETHREAD *CurrentThread; 
  unsigned int v6; 
  NTSTATUS v9; 
  unsigned __int8 *v10; 
  unsigned int v11; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = Length;
  v9 = -1073741789;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceSharedLite(*((_QWORD *)AccessToken + 6), 1);
  v10 = (unsigned __int8 *)**((_QWORD **)AccessToken + 19);
  v11 = 4 * v10[1] + 8;
  if( v6 >= v11 )
  {
    RtlCopySid(v11, UserSid, v10);
    v9 = 0;
  }
  ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
  KeLeaveCriticalRegion();
  if( RequiredLength )
    *(_DWORD *)RequiredLength = v11;
  return v9;
}

Referenced by: