NtAdjustPrivilegesToken

NTSTATUS __stdcall NtAdjustPrivilegesToken(
        VOID *TokenHandle,
        UINT8 DisableAllPrivileges,
        _TOKEN_PRIVILEGES *NewState,
        UINT64 BufferLength,
        _TOKEN_PRIVILEGES *PreviousState,
        UINT64 *ReturnLength){
  UINT v6; 
  INT8 v10; 
  __int64 v11; 
  char *v12; 
  _TOKEN_PRIVILEGES *v13; 
  NTSTATUS result; 
  int v15; 
  _ETHREAD *CurrentThread; 
  __int64 v17; 
  _LUID_AND_ATTRIBUTES *v18; 
  __int64 v19; 
  INT64 v20; 
  UINT v21; 
  signed __int32 v22[8]; 
  PVOID *Object; 
  UINT *ChangeCount; 
  UINT8 *ChangesMade; 
  INT8 RequestorMode; 
  _DWORD ArrayCount[3]; 
  UINT v28; 
  UINT v29; 
  _LUID_AND_ATTRIBUTES *NewStatea; 
  NTSTATUS v31; 
  int v32[3]; 
  UINT8 v33; 
  v6 = BufferLength;
  ArrayCount[0] = 0;
  NewStatea = 0i64;
  v32[0] = 0;
  v28 = 0;
  v29 = 0;
  v33 = 0;
  if( !DisableAllPrivileges && !NewState )
    return -1073741811;
  v10 = *((_BYTE *)KeGetCurrentThread() + 562);
  RequestorMode = v10;
  if( v10 )
  {
    if( DisableAllPrivileges )
    {
      v11 = 0x7FFFFFFF0000i64;
    }
    else
    {
      if( ((unsigned __int8)NewState & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v11 = 0x7FFFFFFF0000i64;
      ArrayCount[0] = NewState->PrivilegeCount;
      v32[1] = 12 * (ArrayCount[0] - 1) + 16;
      if( 12 * (ArrayCount[0] - 1) != -16 )
      {
        v12 = (char *)NewState + (unsigned int)(12 * (ArrayCount[0] - 1) + 16);
        if( (unsigned __int64)v12 > 0x7FFFFFFF0000i64 || v12 < (char *)NewState )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
    }
    v13 = PreviousState;
    if( PreviousState )
    {
      ProbeForWrite(PreviousState, (unsigned int)BufferLength, 4ui64);
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v11 = (__int64)ReturnLength;
      *(_DWORD *)v11 = *(_DWORD *)v11;
    }
LABEL_16:
    if( !DisableAllPrivileges )
    {
      ChangesMade = (UINT8 *)v32;
      ChangeCount = (UINT *)&NewStatea;
      result = SeCaptureLuidAndAttributesArray(
                 NewState->Privileges,
                 ArrayCount[0],
                 v10,
                 (LUID_AND_ATTRIBUTES **)BufferLength,
                 (UINT64 *)Object);
      v31 = result;
      if( result < 0 )
        return result;
    }
    goto LABEL_18;
  }
  v13 = PreviousState;
  if( !DisableAllPrivileges )
  {
    ArrayCount[0] = NewState->PrivilegeCount;
    goto LABEL_16;
  }
LABEL_18:
  *(_QWORD *)&ArrayCount[1] = 0i64;
  v15 = ObReferenceObjectByHandle(
          TokenHandle,
          v13 != 0i64 ? 40 : 32,
          (POBJECT_TYPE)SeTokenObjectType,
          v10,
          (PVOID *)&ArrayCount[1],
          0i64);
  if( v15 < 0 )
  {
    if( NewStatea )
      SeReleaseLuidAndAttributesArray(NewStatea, v10);
    return v15;
  }
  else
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    v17 = *(_QWORD *)&ArrayCount[1];
    ExAcquireResourceExclusiveLite(*(ERESOURCE **)(*(_QWORD *)&ArrayCount[1] + 48i64), 1u);
    _InterlockedOr(v22, 0);
    v18 = NewStatea;
    v19 = *(_QWORD *)&ArrayCount[1];
    SepAdjustPrivileges(
      *(_TOKEN **)&ArrayCount[1],
      0i64,
      DisableAllPrivileges,
      ArrayCount[0],
      NewStatea,
      v13,
      &v28,
      &v29,
      &v33);
    if( v13 && (*(_DWORD *)ReturnLength = v28, v28 > v6) )
    {
      _InterlockedOr(v22, 0);
      ExReleaseResourceLite(*(PERESOURCE *)(v17 + 48));
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      HalPutDmaAdapter(*(PADAPTER_OBJECT *)&ArrayCount[1]);
      if( NewStatea )
        SeReleaseLuidAndAttributesArray(NewStatea, v10);
      return -1073741789;
    }
    else
    {
      LOBYTE(v20) = 1;
      v31 = SepAdjustPrivileges((_TOKEN *)v19, v20, DisableAllPrivileges, ArrayCount[0], v18, v13, &v28, &v29, &v33);
      if( v13 )
      {
        v21 = v29;
        v13->PrivilegeCount = v29;
        if( !v21 )
        {
          v13->Privileges[0].Luid = 0i64;
          v13->Privileges[0].Attributes = 0;
        }
      }
      if( v33 )
        *(_QWORD *)(v19 + 56) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
      _InterlockedOr(v22, 0);
      ExReleaseResourceLite(*(PERESOURCE *)(v17 + 48));
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      HalPutDmaAdapter(*(PADAPTER_OBJECT *)&ArrayCount[1]);
      if( NewStatea )
        SeReleaseLuidAndAttributesArray(NewStatea, v10);
      return v31;
    }
  }
}

Referenced by: