SepReferenceCachedTokenHandles
NTSTATUS __stdcall SepReferenceCachedTokenHandles(UINT64 a1, _XSTATE_FEATURE **a2, INT64 a3){
int v3;
__int64 v4;
unsigned int v7;
VOID **v8;
UINT64 HandleAttributes;
UINT64 Options;
v3 = 0;
v4 = 0i64;
v7 = a1;
if( (_DWORD)a1 )
{
while( 1 )
{
v8 = (VOID **)(a3 + 8 * v4);
LODWORD(Options) = 2;
LODWORD(HandleAttributes) = 512;
v3 = ZwDuplicateObject(
(VOID *)0xFFFFFFFFFFFFFFFFi64,
*a2,
(VOID *)0xFFFFFFFFFFFFFFFFi64,
v8,
0,
HandleAttributes,
Options);
if( v3 < 0 )
break;
v4 = (unsigned int)(v4 + 1);
++a2;
if( (unsigned int)v4 >= v7 )
return v3;
}
for( ; (_DWORD)v4; LODWORD(v4) = v4 - 1 )
ZwClose((_HANDLE)*v8--);
}
return v3;
}Referenced by:
SepSetTokenCachedHandles