PspOneDirectionSecurityDomainCombine

INT64 __fastcall PspOneDirectionSecurityDomainCombine(
        _TOKEN *Token,
        INT64 MakeChanges,
        INT64 ResetToDefault,
        UINT64 GroupCount,
        _SID_AND_ATTRIBUTES *NewState,
        _TOKEN_GROUPS *PreviousState,
        VOID *SidBuffer,
        UINT *ReturnLength,
        UINT *ChangeCount,
        UINT8 *ChangesMade){
  void *PrimaryGroup; 
  INT64 AccessState; 
  _EPROCESS *v13; 
  unsigned int *v14; 
  int v15[8]; 
  POBJECT_TYPE ObjectType; 
  _EPROCESS *Process; 
  HANDLE Handle; 
  INT64 result[4]; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int64 v21[28]; 
  memset((INT64)result, 0i64);
  memset((INT64)v21, 0i64);
  PrimaryGroup = Token[1].PrimaryGroup;
  Process = 0i64;
  Handle = 0i64;
  LODWORD(AccessState) = PsLookupProcessByProcessId(PrimaryGroup, (PEPROCESS *)&Process);
  if( (int)AccessState < 0 )
    goto LABEL_17;
  v13 = Process;
  LODWORD(AccessState) = PspIsParentProcess((INT64)Process, (INT64)Token);
  if( !(_BYTE)AccessState || (*((_DWORD *)v13 + 543) & 0x400000) == 0 )
    goto LABEL_12;
  _InterlockedOr(v15, 0);
  if( SLODWORD(Token[2].RestrictedSids) < 0 )
  {
LABEL_17:
    v13 = Process;
    goto LABEL_12;
  }
  v13 = Process;
  if( *((int *)Process + 628) >= 0 )
  {
    LODWORD(ObjectType) = 40;
    AccessState = SeCreateAccessStateEx(
                    0i64,
                    Process,
                    (_ACCESS_STATE *)result,
                    (_AUX_ACCESS_DATA *)v21,
                    (UINT64)ObjectType,
                    (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
    if( (int)AccessState >= 0 )
    {
      if( ObOpenObjectByPointer(Token, 0x600u, (PACCESS_STATE)result, 0, (POBJECT_TYPE)PsProcessType, 0, &Handle) >= 0 )
      {
        Token[2].DefaultDacl = (_ACL *)*((_QWORD *)v13 + 316);
        if( (*((_DWORD *)v13 + 628) | LODWORD(Token[2].RestrictedSids)) < 0 )
        {
          _InterlockedOr((volatile signed __int32 *)&Token[1].CapabilitiesHash.Hash[21] + 1, 0x200000u);
          v14 = (unsigned int *)_InterlockedIncrement64(&PsNextSecurityDomain);
          Token[2].DynamicPart = v14;
          Token[2].DefaultDacl = (_ACL *)v14;
        }
        v13 = Process;
      }
      SepDeleteAccessState((ACCESS_STATE *)result);
      SeReleaseSubjectContext(&SubjectContext);
    }
  }
LABEL_12:
  if( Handle )
    LODWORD(AccessState) = ObCloseHandle(Handle, 0);
  if( v13 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v13);
  return AccessState;
}

Referenced by: