SeSetVirtualizationToken
VOID __stdcall SeSetVirtualizationToken(PVOID AccessToken, UINT64 Virtualization){
_ETHREAD *CurrentThread;
int v3;
int v5;
unsigned int v6;
signed __int32 v7[10];
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = Virtualization;
--*((_WORD *)CurrentThread + 242);
ExAcquireResourceExclusiveLite(*((ERESOURCE **)AccessToken + 6), 1u);
_InterlockedOr(v7, 0);
v5 = *((_DWORD *)AccessToken + 50);
if( !v3 )
{
v6 = v5 & 0xFFFFFBFF;
goto LABEL_5;
}
if( (v5 & 0x200) != 0 )
{
v6 = v5 | 0x400;
LABEL_5:
*((_DWORD *)AccessToken + 50) = v6;
}
*((_QWORD *)AccessToken + 7) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v7, 0);
ExReleaseResourceLite(*((PERESOURCE *)AccessToken + 6));
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}Referenced by:
NtSetInformationProcess
NtSetInformationToken