CmpBuildAdminInformation

INT64 __stdcall CmpBuildAdminInformation(TOKEN_ACCESS_INFORMATION **AdminInformation){
  INT64 *v1; 
  VOID *v2; 
  unsigned int v3; 
  _DWORD **v4; 
  unsigned int v5; 
  unsigned int v6; 
  unsigned int v7; 
  unsigned int v8; 
  int v9; 
  __int64 v10; 
  void *v11; 
  unsigned int v12; 
  unsigned int v13; 
  int v14; 
  unsigned int v15; 
  size_t v16; 
  char *TransientPoolWithTag; 
  char *v18; 
  unsigned int *v19; 
  unsigned int v20; 
  __int64 v21; 
  __int64 v22; 
  UINT64 v23; 
  __int64 v25; 
  __int64 v26; 
  _SID_AND_ATTRIBUTES *v27; 
  VOID *TokenInformation; 
  VOID *NextTargetSid; 
  PSE_EXPORTS v30; 
  _SID_AND_ATTRIBUTES Source[2]; 
  UINT64 TargetSidBufferSize; 
  NTSTATUS v34; 

  NextTargetSid = 0i64;
  LODWORD(TargetSidBufferSize) = 0;
  TokenInformation = 0i64;
  v2 = (VOID *)CmpEffectiveTokenForSubject(v1, 0i64);
  v34 = SeQueryInformationToken(v2, TokenAccessInformation, &TokenInformation);
  v3 = v34;
  if( v34 >= 0 )
  {
    v4 = (_DWORD **)TokenInformation;
    v5 = 0;
    v6 = -1;
    v7 = -1;
    v8 = **(_DWORD **)TokenInformation;
    v9 = 16 * v8;
    if( v8 )
    {
      v10 = *(_QWORD *)(*(_QWORD *)TokenInformation + 8i64);
      v30 = SeExports;
      do
      {
        v11 = *(void **)v10;
        NextTargetSid = *(VOID **)v10;
        v9 += RtlLengthSid((INT64)NextTargetSid);
        if( v6 == -1 && RtlEqualSid(v30->SeAliasAdminsSid, v11) )
        {
          v6 = v5;
        }
        else if( v7 == -1 && (*(_BYTE *)(v10 + 8) & 0x60) == 96 )
        {
          v7 = v5;
        }
        ++v5;
        v10 += 16i64;
      }
      while( v5 < v8 );
      v4 = (_DWORD **)TokenInformation;
    }
    v12 = 0;
    if( v6 == -1 )
    {
      v12 = 1;
      Source[0].Attributes = 7;
      Source[0].Sid = SeExports->SeAliasAdminsSid;
    }
    if( v7 == -1 )
    {
      v25 = v12++;
      Source[v25].Sid = SeExports->SeHighMandatorySid;
      Source[v25].Attributes = 96;
    }
    if( v12 )
    {
      v26 = v12;
      v27 = Source;
      v9 += 16 * v12;
      do
      {
        v9 += RtlLengthSid((INT64)v27->Sid);
        ++v27;
        --v26;
      }
      while( v26 );
    }
    v13 = (v9 + 7) & 0xFFFFFFF8;
    v14 = 12 * *v4[2];
    v15 = v14 + v13 + 920 - 12;
    if( !v14 )
      v15 = v13 + 920;
    v16 = v15;
    TransientPoolWithTag = (char *)CmpAllocateTransientPoolWithTag(1ui64, v15);
    v18 = TransientPoolWithTag;
    if( TransientPoolWithTag )
    {
      memset(TransientPoolWithTag, 0i64, v16);
      v19 = (unsigned int *)(v18 + 88);
      *((_QWORD *)v18 + 3) = *((_QWORD *)TokenInformation + 3);
      *((_DWORD *)v18 + 8) = *((_DWORD *)TokenInformation + 8);
      *((_DWORD *)v18 + 9) = *((_DWORD *)TokenInformation + 9);
      *((_DWORD *)v18 + 10) = *((_DWORD *)TokenInformation + 10);
      *((_DWORD *)v18 + 11) = *((_DWORD *)TokenInformation + 11) & 0xFFFF9FFF | 0x2000;
      v20 = v12 + **(_DWORD **)TokenInformation;
      *((_QWORD *)v18 + 12) = v18 + 360;
      *((_DWORD *)v18 + 22) = v20;
      RtlCopySidAndAttributesArray(
        **(unsigned int **)TokenInformation,
        *(_SID_AND_ATTRIBUTES **)(*(_QWORD *)TokenInformation + 8i64),
        v13 - 16 * v20,
        (_SID_AND_ATTRIBUTES *)(v18 + 360),
        &v18[16 * v20 + 360],
        &NextTargetSid,
        &TargetSidBufferSize);
      if( v6 != -1 )
        *(_DWORD *)(*((_QWORD *)v18 + 12) + 16i64 * v6 + 8) = 7;
      if( v7 != -1 )
        *(_DWORD *)(*((_QWORD *)v18 + 12) + 16i64 * v7 + 8) = 96;
      if( v12 )
        RtlCopySidAndAttributesArray(
          v12,
          Source,
          (unsigned int)TargetSidBufferSize,
          (_SID_AND_ATTRIBUTES *)(*((_QWORD *)v18 + 12) + 16i64 * **(unsigned int **)TokenInformation),
          NextTargetSid,
          &NextTargetSid,
          &TargetSidBufferSize);
      RtlSidHashInitialize(*((_SID_AND_ATTRIBUTES **)v18 + 12), *v19, (_SID_AND_ATTRIBUTES_HASH *)(v18 + 88));
      *(_QWORD *)v18 = v19;
      v21 = *((_QWORD *)v18 + 12) + v13;
      *(_DWORD *)v21 = 0;
      *(_QWORD *)(v21 + 8) = 0i64;
      *((_QWORD *)v18 + 1) = v21;
      v21 += 272i64;
      *(_DWORD *)v21 = 0;
      v22 = v21 + 272;
      *(_QWORD *)(v21 + 8) = 0i64;
      *((_QWORD *)v18 + 8) = v21;
      *((_QWORD *)v18 + 7) = 0i64;
      v23 = **((unsigned int **)TokenInformation + 2);
      *(_DWORD *)(v21 + 272) = v23;
      RtlCopyLuidAndAttributesArray(v23, *((_QWORD *)TokenInformation + 2) + 4i64, v21 + 276);
      *((_QWORD *)v18 + 2) = v22;
      v3 = v34;
      *AdminInformation = (TOKEN_ACCESS_INFORMATION *)v18;
    }
    else
    {
      v3 = -1073741670;
    }
  }
  if( TokenInformation )
    ExFreePoolWithTag(TokenInformation, 0);
  return v3;
}

Referenced by: