NtAdjustPrivilegesToken

NTSTATUS __fastcall NtAdjustPrivilegesToken(
        UINT64 a1,
        INT8 a2,
        UINT64 a3,
        INT64 a4,
        UINT64 PreviousState,
        UINT64 *ReturnLength){
  unsigned int v6; 
  char PreviousMode; 
  __int64 v11; 
  UINT64 v12; 
  UINT64 v13; 
  NTSTATUS result; 
  int v15; 
  INT64 v16; 
  _ETHREAD *CurrentThread; 
  __int64 v18; 
  _LUID_AND_ATTRIBUTES *v19; 
  __int64 v20; 
  int v21; 
  signed __int32 v22[8]; 
  PVOID *Object; 
  UINT64 *ChangeCount; 
  UINT8 *ChangesMade; 
  INT8 RequestorMode; 
  _DWORD ArrayCount[3]; 
  UINT64 v28; 
  _LUID_AND_ATTRIBUTES *NewState; 
  NTSTATUS v30; 
  _DWORD v31[3]; 
  UINT8 v32; 

  v6 = a4;
  ArrayCount[0] = 0;
  NewState = 0i64;
  v31[0] = 0;
  v28 = 0i64;
  v32 = 0;
  if( !a2 && !a3 )
    return -1073741811;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  RequestorMode = PreviousMode;
  if( PreviousMode )
  {
    if( a2 )
    {
      v11 = 0x7FFFFFFF0000i64;
    }
    else
    {
      if( (a3 & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v11 = 0x7FFFFFFF0000i64;
      ArrayCount[0] = *(_DWORD *)a3;
      v31[1] = 12 * (ArrayCount[0] - 1) + 16;
      if( 12 * (ArrayCount[0] - 1) != -16 )
      {
        v12 = a3 + (unsigned int)(12 * (ArrayCount[0] - 1) + 16);
        if( v12 > 0x7FFFFFFF0000i64 || v12 < a3 )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
    }
    v13 = PreviousState;
    if( PreviousState )
    {
      ProbeForWrite(PreviousState, (unsigned int)a4, 4i64);
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v11 = (__int64)ReturnLength;
      *(_DWORD *)v11 = *(_DWORD *)v11;
    }
LABEL_16:
    if( !a2 )
    {
      ChangesMade = (UINT8 *)v31;
      ChangeCount = (UINT64 *)&NewState;
      result = SeCaptureLuidAndAttributesArray(
                 (_LUID_AND_ATTRIBUTES *)(a3 + 4),
                 ArrayCount[0],
                 PreviousMode,
                 (_LUID_AND_ATTRIBUTES **)a4,
                 (UINT64 *)Object);
      v30 = result;
      if( result < 0 )
        return result;
    }
    goto LABEL_18;
  }
  v13 = PreviousState;
  if( !a2 )
  {
    ArrayCount[0] = *(_DWORD *)a3;
    goto LABEL_16;
  }
LABEL_18:
  *(_QWORD *)&ArrayCount[1] = 0i64;
  v15 = ObReferenceObjectByHandle(
          (VOID *)a1,
          v13 != 0 ? 40 : 32,
          (_OBJECT_TYPE *)SeTokenObjectType,
          PreviousMode,
          (VOID **)&ArrayCount[1],
          0i64);
  if( v15 < 0 )
  {
    if( NewState )
      SeReleaseLuidAndAttributesArray(NewState, PreviousMode);
    return v15;
  }
  else
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v18 = *(_QWORD *)&ArrayCount[1];
    ExAcquireResourceExclusiveLite(*(_QWORD *)(*(_QWORD *)&ArrayCount[1] + 48i64), 1, v16);
    _InterlockedOr(v22, 0);
    v19 = NewState;
    v20 = *(_QWORD *)&ArrayCount[1];
    SepAdjustPrivileges(
      *(_TOKEN **)&ArrayCount[1],
      0,
      a2,
      ArrayCount[0],
      NewState,
      (_TOKEN_PRIVILEGES *)v13,
      &v28,
      (UINT64 *)((char *)&v28 + 4),
      &v32);
    if( v13 && (*(_DWORD *)ReturnLength = v28, (unsigned int)v28 > v6) )
    {
      _InterlockedOr(v22, 0);
      ExReleaseResourceLite(*(PERESOURCE *)(v18 + 48));
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      HalPutDmaAdapter(*(PADAPTER_OBJECT *)&ArrayCount[1]);
      if( NewState )
        SeReleaseLuidAndAttributesArray(NewState, PreviousMode);
      return -1073741789;
    }
    else
    {
      v30 = SepAdjustPrivileges(
              (_TOKEN *)v20,
              1u,
              a2,
              ArrayCount[0],
              v19,
              (_TOKEN_PRIVILEGES *)v13,
              &v28,
              (UINT64 *)((char *)&v28 + 4),
              &v32);
      if( v13 )
      {
        v21 = HIDWORD(v28);
        *(_DWORD *)v13 = HIDWORD(v28);
        if( !v21 )
        {
          *(_QWORD *)(v13 + 4) = 0i64;
          *(_DWORD *)(v13 + 12) = 0;
        }
      }
      if( v32 )
        *(_QWORD *)(v20 + 56) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
      _InterlockedOr(v22, 0);
      ExReleaseResourceLite(*(PERESOURCE *)(v18 + 48));
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      HalPutDmaAdapter(*(PADAPTER_OBJECT *)&ArrayCount[1]);
      if( NewState )
        SeReleaseLuidAndAttributesArray(NewState, PreviousMode);
      return v30;
    }
  }
}

Referenced by: