BiAdjustPrivilege

INT64 __stdcall BiAdjustPrivilege(UINT64 Privilege, UINT8 Enable, UINT8 *WasEnabled){
  unsigned int v3; 
  NTSTATUS v6; 
  unsigned int v7; 
  NTSTATUS v9; 
  HANDLE Handle; 
  UINT64 ReturnLength[2]; 
  struct _TOKEN_PRIVILEGES NewState; 
  struct _TOKEN_PRIVILEGES PreviousState; 
  LODWORD(ReturnLength[0]) = 0;
  NewState.Privileges[0].Attributes = 0;
  v3 = Privilege;
  Handle = (HANDLE)-1i64;
  PreviousState = 0i64;
  if( (*((_DWORD *)KeGetCurrentThread() + 324) & 8) != 0 )
  {
    v6 = ZwOpenThreadTokenEx((PVOID)0xFFFFFFFFFFFFFFFEi64, 0x28ui64, 1u, 0x200ui64, &Handle);
    if( v6 >= 0 )
      goto LABEL_3;
    v9 = ZwOpenThreadTokenEx((PVOID)0xFFFFFFFFFFFFFFFEi64, 0x28ui64, 0, 0x200ui64, &Handle);
  }
  else
  {
    v9 = ZwOpenProcessTokenEx((PVOID)0xFFFFFFFFFFFFFFFFi64, 0x28ui64, 0x200ui64, &Handle);
  }
  v6 = v9;
LABEL_3:
  if( v6 >= 0 )
  {
    ReturnLength[1] = v3;
    NewState.Privileges[0].Luid = (_LUID)v3;
    v7 = 0;
    NewState.PrivilegeCount = 1;
    if( Enable )
      v7 = 2;
    NewState.Privileges[0].Attributes = v7;
    v6 = ZwAdjustPrivilegesToken(Handle, 0, &NewState, 0x10ui64, &PreviousState, ReturnLength);
    if( v6 == 262 )
      v6 = -1073741727;
    if( v6 >= 0 )
    {
      if( PreviousState.PrivilegeCount )
        *WasEnabled = (PreviousState.Privileges[0].Attributes & 2) != 0;
      else
        *WasEnabled = Enable != 0;
    }
    if( Handle != (HANDLE)-1i64 )
      ZwClose(Handle);
  }
  return(unsigned int)v6;
}

Referenced by: