SepCaptureTokenSecurityOperations

NTSTATUS __stdcall SepCaptureTokenSecurityOperations(
        _TOKEN_SECURITY_ATTRIBUTE_OPERATION *Operations,
        UINT64 AttributeCount,
        INT8 RequestorMode,
        _TOKEN_SECURITY_ATTRIBUTE_OPERATION **CapturedOperations,
        _TOKEN_SECURITY_ATTRIBUTE_OPERATION a5){
  unsigned int v6; 
  unsigned int v8; 
  NTSTATUS result; 
  UINT64 v10; 
  VOID **PoolWithTag; 
  __int64 NumberOfBytes[2]; 

  v6 = AttributeCount;
  v8 = 0;
  NumberOfBytes[0] = 0i64;
  if( !RequestorMode )
  {
    *CapturedOperations = Operations;
    return 0;
  }
  if( *Operations == TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL )
  {
    v10 = 4i64;
    NumberOfBytes[0] = 4i64;
    v6 = 1;
  }
  else
  {
    if( !(_DWORD)AttributeCount )
      return -1073741811;
    result = RtlULongLongMult(4ui64, (unsigned int)AttributeCount, (ULONGLONG *)NumberOfBytes);
    if( result < 0 )
      return result;
    v10 = NumberOfBytes[0];
  }
  if( v10 )
  {
    if( ((unsigned __int8)Operations & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)Operations + v10 > 0x7FFFFFFF0000i64
      || (_TOKEN_SECURITY_ATTRIBUTE_OPERATION *)((char *)Operations + v10) < Operations )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v10, 1884251475i64);
  NumberOfBytes[0] = (__int64)PoolWithTag;
  if( PoolWithTag )
  {
    while( v8 < v6 )
    {
      *((_TOKEN_SECURITY_ATTRIBUTE_OPERATION *)PoolWithTag + v8) = Operations[v8];
      ++v8;
    }
    *CapturedOperations = (_TOKEN_SECURITY_ATTRIBUTE_OPERATION *)PoolWithTag;
    return 0;
  }
  return -1073741801;
}

Referenced by: