PspAssignPrimaryToken

NTSTATUS __stdcall PspAssignPrimaryToken(
        _ETHREAD *CurrentThread,
        INT8 PreviousMode,
        VOID *ProcessHandle,
        VOID *TokenHandle){
  NTSTATUS result; 
  UINT64 v8; 
  _ADAPTER_OBJECT *v9; 
  int IsTokenAssignableToProcess; 
  INT64 v11; 
  _EPROCESS *v12; 
  signed __int64 v13; 
  UINT64 Tag; 
  char pbIsAssignable[8]; 
  PVOID Object; 
  VOID *pAccessToken; 
  VOID *OldAccessToken; 

  Object = 0i64;
  pAccessToken = 0i64;
  pbIsAssignable[0] = 0;
  result = ObReferenceObjectByHandle(
             TokenHandle,
             1ui64,
             (_OBJECT_TYPE *)SeTokenObjectType,
             PreviousMode,
             &pAccessToken,
             0i64);
  if( result >= 0 )
  {
    v9 = (_ADAPTER_OBJECT *)pAccessToken;
    IsTokenAssignableToProcess = SeIsTokenAssignableToProcess(pAccessToken, (UINT8 *)pbIsAssignable, v8);
    if( IsTokenAssignableToProcess >= 0 )
    {
      if( pbIsAssignable[0]
        || (LOBYTE(v11) = PreviousMode,
            SeCheckPrivilegedObject(SeAssignPrimaryTokenPrivilege, ProcessHandle, 0x200ui64, v11)) )
      {
        LODWORD(Tag) = 1699967824;
        IsTokenAssignableToProcess = ObReferenceObjectByHandleWithTag(
                                       ProcessHandle,
                                       0x200ui64,
                                       (_OBJECT_TYPE *)PsProcessType,
                                       PreviousMode,
                                       Tag,
                                       &Object,
                                       0i64);
        if( IsTokenAssignableToProcess >= 0 )
        {
          v12 = (_EPROCESS *)Object;
          OldAccessToken = 0i64;
          if( (*((_DWORD *)Object + 280) & 0x8000) != 0 )
          {
            IsTokenAssignableToProcess = -1073741637;
          }
          else
          {
            PspLockProcessSecurityShared((PEPROCESS)Object, CurrentThread);
            if( (v12->Flags2 & 0x8000) != 0 )
            {
              IsTokenAssignableToProcess = -1073741637;
            }
            else
            {
              IsTokenAssignableToProcess = SeExchangePrimaryToken(v12, v9, &OldAccessToken);
              if( IsTokenAssignableToProcess >= 0 )
              {
                v12 = (_EPROCESS *)Object;
                v13 = _InterlockedIncrement64(&PsNextSecurityDomain);
                v9 = (_ADAPTER_OBJECT *)pAccessToken;
                *((_QWORD *)Object + 316) = v13;
                v12->ParentSecurityDomain = v13;
              }
            }
            PspUnlockProcessSecurityShared(v12, CurrentThread);
          }
          if( IsTokenAssignableToProcess >= 0 )
          {
            PspLockUnlockProcessExclusive(v12, CurrentThread);
            HalPutDmaAdapter((PADAPTER_OBJECT)OldAccessToken);
            ObDereferenceDeviceMap(v12);
          }
          ObfDereferenceObjectWithTag(v12, 0x65537350ui64);
        }
      }
      else
      {
        IsTokenAssignableToProcess = -1073741727;
      }
    }
    HalPutDmaAdapter(v9);
    return IsTokenAssignableToProcess;
  }
  return result;
}

Referenced by: