ExpWnfQueryCurrentUserSID

__int64 __fastcall ExpWnfQueryCurrentUserSID(__int64 a1, __int64 a2, void *a3, ULONG *a4, _DWORD *a5){
  int v5; 
  struct _DMA_ADAPTER *v9; 
  _TOKEN_TYPE v10; 
  int UserSidToken; 
  struct _DMA_ADAPTER *v13; 
  _TOKEN_TYPE TokenType; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel[9]; 
  UINT8 EffectiveOnly; 
  v5 = 0;
  TokenType = 0;
  EffectiveOnly = 0;
  ImpersonationLevel[0] = SecurityAnonymous;
  if( !a2 )
  {
    v9 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)a1);
    v10 = TokenPrimary;
LABEL_3:
    UserSidToken = SeQueryUserSidToken(v9, a3, *a4, (UINT64 *)a4);
    if( v10 == TokenPrimary )
    {
      ObFastDereferenceObject((INT64 *)(a1 + 1208), v9);
    }
    else if( v9 )
    {
      HalPutDmaAdapter(v9);
    }
    if( UserSidToken >= 0 )
    {
      LOBYTE(v5) = v10 == TokenPrimary;
      *a5 = v5;
    }
    return(unsigned int)UserSidToken;
  }
  v13 = (struct _DMA_ADAPTER *)PsReferenceEffectiveToken(
                                 (_ETHREAD *)a2,
                                 &TokenType,
                                 &EffectiveOnly,
                                 ImpersonationLevel,
                                 0i64);
  v10 = TokenType;
  v9 = v13;
  if( TokenType != TokenImpersonation || ImpersonationLevel[0] >= SecurityImpersonation )
    goto LABEL_3;
  if( v13 )
    HalPutDmaAdapter(v13);
  return 3221225637i64;
}

Referenced by: