SeQueryUserSidToken

INT64 __stdcall SeQueryUserSidToken(VOID *AccessToken, VOID *UserSid, UINT64 Length, UINT64 *RequiredLength){
  _ETHREAD *CurrentThread; 
  ULONG v6; 
  void *v7; 
  unsigned int v9; 
  unsigned __int8 *v10; 
  ULONG v11; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = Length;
  v7 = UserSid;
  v9 = -1073741789;
  --*((_WORD *)CurrentThread + 242);
  LOBYTE(UserSid) = 1;
  ExAcquireResourceSharedLite(*((PERESOURCE *)AccessToken + 6), (BOOL)UserSid);
  v10 = (unsigned __int8 *)**((_QWORD **)AccessToken + 19);
  v11 = 4 * v10[1] + 8;
  if( v6 >= v11 )
  {
    RtlCopySid(v11, v7, v10);
    v9 = 0;
  }
  ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
  KeLeaveCriticalRegion();
  if( RequiredLength )
    *(_DWORD *)RequiredLength = v11;
  return v9;
}

Referenced by: