SepCreateClientSecurityEx

INT64 __fastcall SepCreateClientSecurityEx(
        _TOKEN *Token,
        _SECURITY_QUALITY_OF_SERVICE *ClientSecurityQos,
        INT64 ServerIsRemote,
        _TOKEN_TYPE TokenType,
        INT64 ThreadEffectiveOnly,
        _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
        INT64 ReturnAnonymous,
        _ETHREAD *Thread,
        UINT8 UsePrimaryTrust,
        VOID *PrimaryTokenTrustSid,
        _SECURITY_CLIENT_CONTEXT *ClientContext){
  char v12; 
  unsigned __int8 v13; 
  _QWORD *SourceName; 
  _SECURITY_IMPERSONATION_LEVEL v15; 
  _SECURITY_CLIENT_CONTEXT *v16; 
  unsigned __int8 EffectiveOnly; 
  INT64 result; 
  bool v19; 
  CHAR v20; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v22; 
  struct _DMA_ADAPTER *v23; 
  struct _DMA_ADAPTER *v24; 
  INT64 v25; 
  int AnonymousToken; 
  __int64 v27; 
  CHAR v28; 
  _EJOB *CurrentServerSilo; 
  VOID *ProcessTrustSid; 
  PVOID DuplicateToken; 
  _EJOB *ServerSilo; 
  PADAPTER_OBJECT DmaAdapter; 
  v12 = 0;
  DuplicateToken = 0i64;
  v13 = ServerIsRemote;
  DmaAdapter = 0i64;
  SourceName = Token->TokenSource.SourceName;
  if( ClientSecurityQos->ContextTrackingMode >= 2u )
    return 3221225485i64;
  v15 = ClientSecurityQos->ImpersonationLevel;
  if( (unsigned int)v15 > SecurityDelegation )
    return 3221225637i64;
  if( TokenType == TokenImpersonation )
  {
    if( v15 > ImpersonationLevel )
    {
      if( !(_BYTE)ReturnAnonymous )
        return 3221225637i64;
      v12 = 1;
    }
    if( (unsigned int)ImpersonationLevel > SecurityIdentification
      && (!(_BYTE)ServerIsRemote || ImpersonationLevel == SecurityDelegation) )
    {
      v19 = (_BYTE)ThreadEffectiveOnly || ClientSecurityQos->EffectiveOnly;
      v16 = ClientContext;
      ClientContext->DirectAccessEffectiveOnly = v19;
      if( !v12 )
        goto LABEL_5;
LABEL_28:
      if( (Token->TokenFlags & 0x4000) == 0 )
      {
        if( Thread )
        {
          CurrentThread = (_ETHREAD *)KeGetCurrentThread();
          if( Thread == CurrentThread )
            v22 = (_EPROCESS *)*((_QWORD *)CurrentThread + 23);
          else
            v22 = (_EPROCESS *)*((_QWORD *)Thread + 68);
          v23 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)v22);
          v24 = v23;
          if( ((__int64)v23[12].DmaOperations & 0x4000) != 0 )
            v25 = (INT64)v23;
          else
            v25 = 0i64;
          AnonymousToken = SepGetAnonymousToken(v25, &DmaAdapter);
          HalPutDmaAdapter(v24);
LABEL_35:
          if( AnonymousToken < 0 )
            return(unsigned int)AnonymousToken;
          SourceName = &DmaAdapter->Version;
          LODWORD(ProcessTrustSid) = 0;
          LODWORD(result) = ObInsertObjectEx(DmaAdapter, 0i64, 0i64, 0i64, (UINT64)ProcessTrustSid, 0i64, 0i64);
          if( (int)result >= 0 )
          {
            *(_QWORD *)&v16->SecurityQos.Length = 12i64;
            v16->SecurityQos.ContextTrackingMode = 0;
            EffectiveOnly = ClientSecurityQos->EffectiveOnly;
            v16->DirectlyAccessClientToken = 0;
            goto LABEL_9;
          }
          return result;
        }
        Token = 0i64;
      }
      AnonymousToken = SepGetAnonymousToken((INT64)Token, &DmaAdapter);
      goto LABEL_35;
    }
    if( (_BYTE)ReturnAnonymous )
    {
      v16 = ClientContext;
      goto LABEL_28;
    }
    return 3221225637i64;
  }
  v16 = ClientContext;
  ClientContext->DirectAccessEffectiveOnly = ClientSecurityQos->EffectiveOnly;
LABEL_5:
  if( ClientSecurityQos->ContextTrackingMode )
  {
    v16->DirectlyAccessClientToken = 1;
    if( (_BYTE)ServerIsRemote )
      SeGetTokenControlInformation(Token, &v16->ClientTokenControl);
LABEL_8:
    v16->SecurityQos.Length = 12;
    v16->SecurityQos.ImpersonationLevel = ClientSecurityQos->ImpersonationLevel;
    v16->SecurityQos.ContextTrackingMode = ClientSecurityQos->ContextTrackingMode;
    EffectiveOnly = ClientSecurityQos->EffectiveOnly;
LABEL_9:
    v16->ClientToken = SourceName;
    v16->SecurityQos.EffectiveOnly = EffectiveOnly;
    result = 0i64;
    v16->ServerIsRemote = v13;
    return result;
  }
  v16->DirectlyAccessClientToken = 0;
  if( PsIsCurrentThreadInServerSilo() )
  {
    v27 = SourceName[3];
    ServerSilo = 0i64;
    if( (int)SeQueryServerSiloToken(SourceName, &ServerSilo) >= 0 && PsIsHostSilo(ServerSilo) && v27 == 999 )
    {
      CurrentServerSilo = PsGetCurrentServerSilo();
      result = SepCopyClientTokenAndSetSilo(
                 SourceName,
                 ClientSecurityQos->ImpersonationLevel,
                 CurrentServerSilo,
                 &DuplicateToken);
    }
    else
    {
      result = SeCopyClientToken(SourceName, ClientSecurityQos->ImpersonationLevel, v28, 0, 0i64, &DuplicateToken);
    }
  }
  else
  {
    result = SeCopyClientToken(
               SourceName,
               ClientSecurityQos->ImpersonationLevel,
               v20,
               UsePrimaryTrust,
               PrimaryTokenTrustSid,
               &DuplicateToken);
  }
  SourceName = DuplicateToken;
  if( (int)result >= 0 )
    goto LABEL_8;
  return result;
}

Referenced by: