SepCopyTokenAccessInformation

INT64 __fastcall SepCopyTokenAccessInformation(
        INT64 a1,
        INT64 a2,
        INT64 a3,
        INT64 a4,
        UINT64 a5,
        UINT64 a6,
        UINT64 a7,
        UINT64 a8,
        INT64 a9,
        UINT64 a10,
        UINT64 a11,
        INT64 a12,
        UINT64 a13,
        CHAR a14,
        UINT8 *a15){
  int v16; 
  int v18; 
  __int64 v19; 
  __int64 v20; 
  UINT8 *v21; 
  int v22; 
  UINT64 v23; 
  VOID *v24; 
  INT64 v25; 
  INT64 v26; 
  UINT64 v27; 
  INT64 v28; 
  INT64 v29; 
  UINT64 v30; 
  UINT8 *v31; 
  UINT8 *v32; 
  UINT8 *v33; 
  UINT8 *v34; 
  UINT64 v35; 
  UINT64 v36; 
  PSID NextTargetSid; 
  *(_QWORD *)(a2 + 24) = *(_QWORD *)(a1 + 24);
  v16 = a4;
  *(_DWORD *)(a2 + 32) = *(_DWORD *)(a1 + 192);
  *(_DWORD *)(a2 + 36) = *(_DWORD *)(a1 + 196);
  *(_DWORD *)(a2 + 44) = *(_DWORD *)(a1 + 200);
  v18 = a2 + a3;
  SeQueryMandatoryPolicyToken((PVOID)a1, (_TOKEN_MANDATORY_POLICY *)(a2 + 40));
  v20 = *(_QWORD *)(v19 + 1080);
  v21 = 0i64;
  v22 = 0;
  if( v20 )
    v22 = *(_DWORD *)(v20 + 40);
  v23 = (unsigned int)(a5 - a6);
  *(_DWORD *)(a2 + 48) = v22;
  *(_DWORD *)(a2 + 88) = *(_DWORD *)(a1 + 124);
  v24 = (VOID *)(a2 + 360 + (unsigned int)a6);
  *(_QWORD *)(a2 + 96) = a2 + 360;
  *(_QWORD *)a2 = a2 + 88;
  RtlCopySidAndAttributesArray(
    *(unsigned int *)(a1 + 124),
    *(SID_AND_ATTRIBUTES **)(a1 + 152),
    v23,
    (SID_AND_ATTRIBUTES *)(a2 + 360),
    v24,
    &NextTargetSid,
    (UINT64 *)&NextTargetSid);
  RtlSidHashInitialize(
    (SID_AND_ATTRIBUTES *)(a2 + 360),
    *(unsigned int *)(a1 + 124),
    (SID_AND_ATTRIBUTES_HASH *)(a2 + 88));
  v25 = a2 + 360 + (unsigned int)a5;
  *(_DWORD *)v25 = *(_DWORD *)(a1 + 128);
  v26 = v25 + 272;
  *(_QWORD *)(v25 + 8) = v25 + 272;
  *(_QWORD *)(a2 + 8) = v25;
  v27 = *(unsigned int *)(a1 + 128);
  if( (_DWORD)v27 )
  {
    RtlCopySidAndAttributesArray(
      v27,
      *(SID_AND_ATTRIBUTES **)(a1 + 160),
      (unsigned int)(a7 - a8),
      (SID_AND_ATTRIBUTES *)(v25 + 272),
      (VOID *)(v26 + (unsigned int)a8),
      &NextTargetSid,
      (UINT64 *)&NextTargetSid);
    RtlSidHashInitialize((SID_AND_ATTRIBUTES *)(v25 + 272), *(unsigned int *)(a1 + 128), (SID_AND_ATTRIBUTES_HASH *)v25);
  }
  v28 = v26 + (unsigned int)a7;
  *(_DWORD *)v28 = *(_DWORD *)(a1 + 800);
  v29 = v28 + 272;
  *(_QWORD *)(v28 + 8) = v28 + 272;
  *(_QWORD *)(a2 + 64) = v28;
  v30 = *(unsigned int *)(a1 + 800);
  if( (_DWORD)v30 )
  {
    RtlCopySidAndAttributesArray(
      v30,
      *(SID_AND_ATTRIBUTES **)(a1 + 792),
      (unsigned int)(a10 - a11),
      (SID_AND_ATTRIBUTES *)(v28 + 272),
      (VOID *)(v29 + (unsigned int)a11),
      &NextTargetSid,
      (UINT64 *)&NextTargetSid);
    RtlSidHashInitialize((SID_AND_ATTRIBUTES *)(v28 + 272), *(unsigned int *)(a1 + 800), (SID_AND_ATTRIBUTES_HASH *)v28);
  }
  v31 = (UINT8 *)(v29 + (unsigned int)a10);
  v32 = 0i64;
  if( (_DWORD)a9 )
  {
    v32 = v31;
    memmove(v31, *(UINT8 **)(a1 + 784), 4i64 * *(unsigned __int8 *)(*(_QWORD *)(a1 + 784) + 1i64) + 8);
  }
  v33 = a15;
  *(_QWORD *)(a2 + 56) = v32;
  if( !a14 )
    v33 = *(UINT8 **)(a1 + 1104);
  v34 = &v31[(unsigned int)a9];
  if( (_DWORD)a12 )
  {
    v21 = v34;
    memmove(v34, v33, 4i64 * v33[1] + 8);
  }
  v35 = (UINT64)&v34[(unsigned int)a12];
  *(_QWORD *)(a2 + 72) = v21;
  AuthzBasepQueryInternalSecurityAttributesToken(
    *(UINT64 **)(a1 + 776),
    v35,
    (unsigned int)(v18 - v35),
    (UINT64 *)&NextTargetSid);
  v36 = v35 + (unsigned int)a13;
  *(_QWORD *)(a2 + 80) = v35;
  *(_DWORD *)v36 = v16;
  *(_QWORD *)(a2 + 16) = v36;
  return SepConvertTokenPrivilegesToLuidAndAttributes((_TOKEN *)a1, (_LUID_AND_ATTRIBUTES *)(v36 + 4));
}

Referenced by: