RtlAcquirePrivilege

NTSTATUS __stdcall RtlAcquirePrivilege(UINT64 *Privilege, UINT64 NumPriv, UINT64 Flags, PVOID *ReturnedState){
  __int64 v5; 
  char v7; 
  char *PoolWithQuotaTag; 
  char *v9; 
  VOID **v10; 
  NTSTATUS v11; 
  __int64 v12; 
  __int64 v13; 
  unsigned int v14; 
  __int64 v15; 
  char *v17; 
  _TOKEN_PRIVILEGES *PreviousState; 
  __int64 ThreadInformation; 
  UINT64 BufferLength; 
  LODWORD(BufferLength) = 0;
  v5 = (unsigned int)NumPriv;
  if( (Flags & 0xFFFFFFFC) != 0 )
    return -1073741811;
  v7 = Flags | 1;
  if( (Flags & 2) == 0 )
    v7 = Flags;
  PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag(
                               (POOL_TYPE)520,
                               12 * ((unsigned int)(NumPriv - 1) + 90i64),
                               0x62507452ui64);
  v9 = PoolWithQuotaTag;
  if( PoolWithQuotaTag )
  {
    *(_QWORD *)PoolWithQuotaTag = 0i64;
    v10 = (VOID **)(PoolWithQuotaTag + 8);
    *((_QWORD *)PoolWithQuotaTag + 1) = 0i64;
    *((_DWORD *)PoolWithQuotaTag + 8) = 0;
    if( (*((_DWORD *)KeGetCurrentThread() + 324) & 8) == 0 )
      goto LABEL_9;
    if( (v7 & 1) != 0 )
    {
      v11 = RtlpOpenThreadToken(4ui64, v10);
      if( v11 >= 0 )
      {
        *((_DWORD *)v9 + 8) |= 1u;
        ThreadInformation = 0i64;
        ZwSetInformationThread((PVOID)0xFFFFFFFFFFFFFFFEi64, ThreadImpersonationToken, &ThreadInformation, 8ui64);
        goto LABEL_9;
      }
    }
    else
    {
      v11 = RtlpOpenThreadToken(0x28ui64, (VOID **)PoolWithQuotaTag);
      if( v11 >= 0 )
      {
LABEL_9:
        if( *(_QWORD *)v9 )
          goto LABEL_13;
        if( (v7 & 2) != 0 )
        {
          v11 = ZwOpenProcessTokenEx((PVOID)0xFFFFFFFFFFFFFFFFi64, 0x28ui64, 0x200ui64, (PVOID *)v9);
          if( v11 >= 0 )
          {
            *((_DWORD *)v9 + 8) |= 2u;
LABEL_13:
            *((_QWORD *)v9 + 3) = v9 + 1064;
            *((_QWORD *)v9 + 2) = v9 + 36;
            *((_DWORD *)v9 + 266) = v5;
            if( (_DWORD)v5 )
            {
              v12 = 0i64;
              v13 = v5;
              do
              {
                v14 = *(_DWORD *)Privilege;
                v12 += 12i64;
                v15 = *((_QWORD *)v9 + 3);
                Privilege = (UINT64 *)((char *)Privilege + 4);
                ThreadInformation = v14;
                *(_QWORD *)(v12 + v15 - 8) = v14;
                *(_DWORD *)(v12 + *((_QWORD *)v9 + 3)) = 2;
                --v13;
              }
              while( v13 );
            }
            LODWORD(BufferLength) = 1024;
            v11 = ZwAdjustPrivilegesToken(
                    *(VOID **)v9,
                    0,
                    *((_TOKEN_PRIVILEGES **)v9 + 3),
                    0x400ui64,
                    *((_TOKEN_PRIVILEGES **)v9 + 2),
                    &BufferLength);
            if( v11 == -1073741789 )
            {
              while( 1 )
              {
                PreviousState = (_TOKEN_PRIVILEGES *)ExAllocatePoolWithQuotaTag(
                                                       (POOL_TYPE)520,
                                                       (unsigned int)BufferLength,
                                                       0x62507452ui64);
                *((_QWORD *)v9 + 2) = PreviousState;
                if( !PreviousState )
                  break;
                v11 = ZwAdjustPrivilegesToken(
                        *(VOID **)v9,
                        0,
                        *((_TOKEN_PRIVILEGES **)v9 + 3),
                        (unsigned int)BufferLength,
                        PreviousState,
                        &BufferLength);
                if( v11 != -1073741789 )
                  goto LABEL_17;
                ExFreePoolWithTag(*((PVOID *)v9 + 2), 0);
              }
              v11 = -1073741801;
            }
LABEL_17:
            if( v11 == 262 )
            {
              if( (_DWORD)v5 == 1 )
              {
                v11 = -1073741727;
LABEL_22:
                v17 = (char *)*((_QWORD *)v9 + 2);
                if( v17 && v17 != v9 + 36 )
                  ExFreePoolWithTag(v17, 0);
                ZwClose(*(HANDLE *)v9);
                goto LABEL_26;
              }
              v11 = 0;
            }
            if( v11 >= 0 )
            {
              *ReturnedState = v9;
              return 0;
            }
            goto LABEL_22;
          }
        }
        else
        {
          v11 = RtlImpersonateSelfEx(SecurityDelegation, 0x28ui64, (PVOID *)v9);
          if( v11 >= 0 )
          {
            *((_DWORD *)v9 + 8) |= 1u;
            goto LABEL_13;
          }
        }
LABEL_26:
        if( (*((_DWORD *)v9 + 8) & 1) != 0 )
        {
          ZwSetInformationThread((PVOID)0xFFFFFFFFFFFFFFFEi64, ThreadImpersonationToken, v10, 8ui64);
          if( *v10 )
            ZwClose(*v10);
        }
      }
    }
    ExFreePoolWithTag(v9, 0);
    return v11;
  }
  return -1073741801;
}

Referenced by: