NtQuerySecurityAttributesToken

NTSTATUS __stdcall NtQuerySecurityAttributesToken(
        VOID *TokenHandle,
        UNICODE_STRING *pAttributes,
        UINT64 AttributeCount,
        VOID *pBuffer,
        UINT64 BufferLength,
        UINT64 *pReturnLength){
  unsigned int v7; 
  char v9; 
  CHAR v10; 
  UINT64 *v11; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  NTSTATUS SecurityAttributesToken; 
  BOOL v15; 
  _ETHREAD *CurrentThread; 
  PADAPTER_OBJECT v17; 
  UNICODE_STRING *v18; 
  VOID *pBuffera; 
  UINT64 *v21; 
  UINT8 UseNewTrust[4]; 
  NTSTATUS v23; 
  PADAPTER_OBJECT DmaAdapter; 
  PVOID P; 
  VOID *TrustLevelSid; 
  UINT8 ForceGlobal; 
  ForceGlobal = AttributeCount;
  v7 = AttributeCount;
  P = 0i64;
  v9 = 0;
  DmaAdapter = 0i64;
  TrustLevelSid = 0i64;
  UseNewTrust[0] = 0;
  v10 = *((_BYTE *)KeGetCurrentThread() + 562);
  UseNewTrust[1] = v10;
  if( (_DWORD)BufferLength )
  {
    if( pBuffer )
      goto LABEL_3;
LABEL_24:
    SecurityAttributesToken = -1073741811;
    v23 = -1073741811;
LABEL_25:
    v17 = DmaAdapter;
    goto LABEL_15;
  }
  if( pBuffer )
    goto LABEL_24;
LABEL_3:
  if( v10 )
  {
    ProbeForWrite(pBuffer, (unsigned int)BufferLength, 4ui64);
    v11 = pReturnLength;
    if( ((unsigned __int8)pReturnLength & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v12 = (unsigned __int64)pReturnLength + 3;
    if( pReturnLength > (UINT64 *)((char *)pReturnLength + 3) || v12 >= 0x7FFFFFFF0000i64 )
      ExRaiseAccessViolation();
    v13 = (v12 & 0xFFFFFFFFFFFFF000ui64) + 4096;
    do
    {
      *(_BYTE *)v11 = *(_BYTE *)v11;
      v11 = (UINT64 *)(((unsigned __int64)v11 & 0xFFFFFFFFFFFFF000ui64) + 4096);
    }
    while( v11 != (UINT64 *)v13 );
  }
  SecurityAttributesToken = SepCaptureUnicodeStringArray(pAttributes, v7, v10, (const _UNICODE_STRING **)&P);
  v23 = SecurityAttributesToken;
  if( SecurityAttributesToken < 0 )
    goto LABEL_25;
  SecurityAttributesToken = SepReferenceTokenByHandle(
                              TokenHandle,
                              8ui64,
                              v10,
                              (_TOKEN **)&DmaAdapter,
                              UseNewTrust,
                              &TrustLevelSid);
  v23 = SecurityAttributesToken;
  if( SecurityAttributesToken < 0 )
    goto LABEL_25;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  LOBYTE(v15) = 1;
  v17 = DmaAdapter;
  ExAcquireResourceSharedLite(*(PERESOURCE *)&DmaAdapter[3].Version, v15);
  v9 = 1;
  LODWORD(v21) = BufferLength;
  LOBYTE(pBuffera) = 0;
  SecurityAttributesToken = SepInternalQuerySecurityAttributesTokenEx(
                              v17,
                              v18,
                              (UINT64)P,
                              ForceGlobal,
                              pBuffera,
                              (UINT64)pBuffer,
                              v21);
  v23 = SecurityAttributesToken;
LABEL_15:
  if( v10 == 1 && P )
    ExFreePoolWithTag(P, 0);
  if( v9 )
  {
    ExReleaseResourceLite(*(PERESOURCE *)&v17[3].Version);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    SecurityAttributesToken = v23;
    v17 = DmaAdapter;
  }
  if( v17 )
    HalPutDmaAdapter(v17);
  return SecurityAttributesToken;
}

Referenced by: