NtAdjustGroupsToken

INT64 __fastcall NtAdjustGroupsToken(
        VOID *TokenHandle,
        UINT8 ResetToDefault,
        _TOKEN_GROUPS *NewState,
        UINT64 BufferLength,
        _TOKEN_GROUPS *PreviousState,
        UINT64 *ReturnLength){
  void *v9; 
  INT8 v10; 
  __int64 v11; 
  _TOKEN_GROUPS *v12; 
  INT64 result; 
  NTSTATUS v14; 
  _ETHREAD *CurrentThread; 
  _TOKEN *v16; 
  _SID_AND_ATTRIBUTES *v17; 
  INT64 v18; 
  _TOKEN *v19; 
  int v20; 
  UINT64 *v21; 
  INT64 v22; 
  signed __int32 v23[8]; 
  PVOID *Object; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  PSID DestinationSid; 
  INT8 RequestorMode; 
  UINT ChangeCount[2]; 
  unsigned int v29; 
  UINT64 GroupCount; 
  _TOKEN *v31; 
  _SID_AND_ATTRIBUTES *NewStatea; 
  UINT8 ChangesMade; 
  UINT v34; 
  v34 = BufferLength;
  GroupCount = 0i64;
  NewStatea = 0i64;
  ChangeCount[0] = 0;
  ChangeCount[1] = 0;
  ChangesMade = 0;
  v9 = 0i64;
  if( !ResetToDefault && !NewState )
    return 3221225485i64;
  v10 = *((_BYTE *)KeGetCurrentThread() + 562);
  RequestorMode = v10;
  if( v10 )
  {
    if( ResetToDefault )
    {
      v11 = 0x7FFFFFFF0000i64;
    }
    else
    {
      if( ((unsigned __int8)NewState & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v11 = 0x7FFFFFFF0000i64;
    }
    v12 = PreviousState;
    if( PreviousState )
    {
      ProbeForWrite(PreviousState, (unsigned int)BufferLength, 4ui64);
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v11 = (__int64)ReturnLength;
      *(_DWORD *)v11 = *(_DWORD *)v11;
    }
  }
  else
  {
    v12 = PreviousState;
  }
  if( ResetToDefault
    || (LODWORD(GroupCount) = NewState->GroupCount,
        LODWORD(Object) = 0,
        result = SeCaptureSidAndAttributesArray(
                   NewState->Groups,
                   (unsigned int)GroupCount,
                   v10,
                   0i64,
                   (UINT64)Object,
                   (_POOL_TYPE)HandleInformation,
                   (UINT8)DestinationSid,
                   &NewStatea,
                   (UINT64 *)((char *)&GroupCount + 4)),
        v29 = result,
        (int)result >= 0) )
  {
    v31 = 0i64;
    v14 = ObReferenceObjectByHandle(
            TokenHandle,
            v12 != 0i64 ? 72 : 64,
            (POBJECT_TYPE)SeTokenObjectType,
            v10,
            (PVOID *)&v31,
            0i64);
    if( v14 < 0 )
    {
      if( NewStatea )
        SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)NewStatea, v10);
      return(unsigned int)v14;
    }
    else
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      v16 = v31;
      ExAcquireResourceExclusiveLite(v31->TokenLock, 1u);
      _InterlockedOr(v23, 0);
      v17 = NewStatea;
      LOBYTE(v18) = ResetToDefault;
      v19 = v31;
      v20 = SepAdjustGroups(
              v31,
              0i64,
              v18,
              (unsigned int)GroupCount,
              NewStatea,
              v12,
              0i64,
              ChangeCount,
              &ChangeCount[1],
              &ChangesMade);
      v29 = v20;
      if( v12 )
      {
        v21 = ReturnLength;
        *(_DWORD *)ReturnLength = ChangeCount[0];
      }
      if( v20 < 0 )
        goto LABEL_24;
      if( !v12 )
      {
LABEL_20:
        LOBYTE(v22) = ResetToDefault;
        LOBYTE(v21) = 1;
        v29 = SepAdjustGroups(
                v19,
                (INT64)v21,
                v22,
                (unsigned int)GroupCount,
                v17,
                v12,
                v9,
                ChangeCount,
                &ChangeCount[1],
                &ChangesMade);
        if( v12 )
          v12->GroupCount = ChangeCount[1];
        if( ChangesMade )
          v19->ModifiedId = (_LUID)(ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement));
LABEL_24:
        _InterlockedOr(v23, 0);
        ExReleaseResourceLite(v16->TokenLock);
        KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
        HalPutDmaAdapter((PADAPTER_OBJECT)v31);
        if( NewStatea )
          SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)NewStatea, v10);
        return v29;
      }
      if( ChangeCount[0] <= v34 )
      {
        v9 = (void *)(((unsigned __int64)&v12->Groups[ChangeCount[1]].Sid + 3) & 0xFFFFFFFFFFFFFFFCui64);
        goto LABEL_20;
      }
      _InterlockedOr(v23, 0);
      ExReleaseResourceLite(v16->TokenLock);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      HalPutDmaAdapter((PADAPTER_OBJECT)v31);
      if( NewStatea )
        SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)NewStatea, v10);
      return 3221225507i64;
    }
  }
  return result;
}

Referenced by: