BOOL GetProcessEleation(DWORD dwPid ,TOKEN_ELEVATION_TYPE* pElevationType, BOOL* pIsadmin)
{
    HANDLE hToken = NULL;
    BOOL bResult = FALSE;
    DWORD dwSize = 0;
    if (!OpenProcessToken(OpenProcess(PROCESS_ALL_ACCESS, TRUE, dwPid), TOKEN_QUERY, &hToken))
    {
        //printf("[!]OpenProcessToken:%d \t\n", GetLastError()); 
        return FALSE;
    }   
    if (GetTokenInformation(hToken, TokenElevationType, pElevationType, sizeof(TokenElevationType), &dwSize)) {
        BYTE adminSID[SECURITY_MAX_SID_SIZE];
        dwSize = sizeof(adminSID);
        if (FALSE == CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, &adminSID, &dwSize))
        {
            printf("[!] CreateWellKnownSid:%d \t\n", GetLastError());
            return FALSE;
        }
        if (*pElevationType == TokenElevationTypeLimited) {
            HANDLE hUnfilteredToken = NULL;
            GetTokenInformation(hToken, TokenLinkedToken, (VOID*)&hUnfilteredToken, sizeof(HANDLE), &dwSize);
            if (CheckTokenMembership(hUnfilteredToken, &adminSID, pIsadmin))
                bResult = TRUE;
            CloseHandle(hUnfilteredToken);
        }
        else
        {
            *pIsadmin = IsUserAnAdmin();
            bResult = TRUE;
        }
    }
    CloseHandle(hToken);
    return bResult;
}

BOOL WINAPI GetTokenInformation(
    _In_ HANDLE TokenHandle,
    _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
    _Out_writes_bytes_to_opt_(TokenInformationLength, *ReturnLength) LPVOID TokenInformation,
    _In_ DWORD TokenInformationLength,
    _Out_ PDWORD ReturnLength
    );
BOOL WINAPI OpenProcessToken(
    _In_ HANDLE ProcessHandle,
    _In_ DWORD DesiredAccess,
    _Outptr_ PHANDLE TokenHandle
    );

BOOL CheckExeSignature(DWORD dwPid)
{
    BOOL bResult = FALSE;
    //LPWSTR pwszSourceFile = NULL;
    WCHAR pwszSourceFile[MAX_PATH] = { 0 };
    TCHAR lpFilePath[MAX_PATH] = {0};
    GetProcessPath(dwPid, lpFilePath);
    MultiByteToWideChar(CP_ACP, 0, lpFilePath, strlen(lpFilePath) + 1, pwszSourceFile, sizeof(pwszSourceFile) / sizeof(pwszSourceFile[0]));
    if (VerifyEmbeddedSignature(pwszSourceFile) == ERROR_SUCCESS)
    {
        bResult = CheckMiscrosoftSignature(pwszSourceFile);
    }
    return bResult;
}

BOOL  CheckFusion(TCHAR* lpFilePath)
{
    BOOL bResult = FALSE;
    HANDLE hFile = CreateFile(lpFilePath, GENERIC_READ, FILE_SHARE_DELETE | FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile == NULL)
    {
        return FALSE;
    }
    ACTCTXW pActCtx;
    WCHAR lpwFilePath[MAX_PATH] = { 0 };
    MultiByteToWideChar(CP_ACP, 0, lpFilePath, strlen(lpFilePath) + 1, lpwFilePath, sizeof(lpwFilePath) / sizeof(lpwFilePath[0]));
    memset(&pActCtx, 0, sizeof(ACTCTXW));
    pActCtx.cbSize = 32;
    pActCtx.lpSource = lpwFilePath;
    pActCtx.lpResourceName = MAKEINTRESOURCEW(1);
    pActCtx.dwFlags = 8;
    HANDLE hMapping = NULL;
    LPVOID lpStartAddress = NULL;
    hMapping  = CreateFileMappingW(hFile, 0, 0x1000002u, 0, 0, 0);
    if (hMapping)
    {
        lpStartAddress = MapViewOfFile(hMapping, 4u, 0, 0, 0);
        if (lpStartAddress)
        {
            pActCtx.dwFlags |= 0x80u;
            pActCtx.hModule = (HMODULE)lpStartAddress;
        }
    }
    else
    {
        hMapping = 0;
    }
    HANDLE hActCtx = CreateActCtxW(&pActCtx);
    WCHAR pvBuffer[MAX_PATH] = {0};
    if (hActCtx != INVALID_HANDLE_VALUE)
    {
        if (QueryActCtxSettingsW(0, hActCtx, 0, L"autoElevate", pvBuffer, 8u, 0) && (pvBuffer[0] == 't' || pvBuffer[0] == 'T'))
            bResult = TRUE;
        ReleaseActCtx(hActCtx);
    }
    if (lpStartAddress)
        UnmapViewOfFile(lpStartAddress);
    if (hMapping)
        CloseHandle(hMapping);
    return bResult;
}

bool __stdcall AipIsAutoApprovalEXE(const unsigned __int16 *Key)
{
  bool result; // al
  return _bsearch(Key, &g_lpAutoApproveEXEList, 0xCu, 4u, AipCompareEXE) != 0;
}
.data:6B0FB054 unsigned short const * * g_lpAutoApproveEXEList dd offset aCttunesvrExe
.data:6B0FB054                                         ; DATA XREF: AipIsAutoApprovalEXE(ushort const *)+E↑o
.data:6B0FB054                                         ; "cttunesvr.exe"
.data:6B0FB058                 dd offset aInetmgrExe   ; "inetmgr.exe"
.data:6B0FB05C                 dd offset aInfdefaultinst ; "infdefaultinstall.exe"
.data:6B0FB060                 dd offset aMigsetupExe  ; "migsetup.exe"
.data:6B0FB064                 dd offset aMigwizExe    ; "migwiz.exe"
.data:6B0FB068                 dd offset aMmcExe       ; "mmc.exe"
.data:6B0FB06C                 dd offset aOobeExe      ; "oobe.exe"
.data:6B0FB070                 dd offset aPkgmgrExe    ; "pkgmgr.exe"
.data:6B0FB074                 dd offset aProvisionshare ; "provisionshare.exe"
.data:6B0FB078                 dd offset aProvisionstora ; "provisionstorage.exe"
.data:6B0FB07C                 dd offset aSpinstallExe ; "spinstall.exe"
.data:6B0FB080                 dd offset aWinsatExe    ; "winsat.exe"

typedef struct _PROCESS_LONNK_READDATA
{
    HANDLE  hProcessId;              //进程的PID
    TCHAR szProcessName[MAX_PATH];   //进程名
    HANDLE hParentId;                //父进程PID
    TCHAR szParentProcessName[MAX_PATH]; //父进程进程名
}PROCESS_LONNK_READDATA, *PPROCESS_LONNK_READDATA;

//创建事件
UNICODE_STRING EventName = { 0 };
ntStatus = RtlUnicodeStringInit(&EventName, IBINARY_EVENTNAME);
if (!NT_SUCCESS(ntStatus))
{
    DbgPrint("RtlUnicodeStringInit EventName :%d", ntStatus);
    return ntStatus;
}
PDEVICE_EXTEN pDeviceExten = (PDEVICE_EXTEN)pDeviceObject->DeviceExtension;
if (pDeviceExten == NULL)
{
    DbgPrint("pDeviceExten Failed");
    return ntStatus;
}
pDeviceExten->pkProcessEvent = IoCreateNotificationEvent(&EventName, &pDeviceExten->hProcessId);
KeClearEvent(pDeviceExten->pkProcessEvent);

VOID pfnCreateProcessRoutine(
    PEPROCESS Process,
    HANDLE ProcessId,
    PPS_CREATE_NOTIFY_INFO CreateInfo
    )
{
    NTSTATUS ntStatus = STATUS_SUCCESS;
    if (CreateInfo != NULL)
    {
        PDEVICE_EXTEN pDeviceExten = (PDEVICE_EXTEN)g_pDeviceObject->DeviceExtension;
        pDeviceExten->hProcessId = ProcessId;
        pDeviceExten->hParentId = CreateInfo->ParentProcessId;
        //获取父进程的进程名
        PEPROCESS pParentEprocess = NULL;
        ntStatus = PsLookupProcessByProcessId(pDeviceExten->hParentId, &pParentEprocess);
        if (pParentEprocess != NULL)
        {
            PCHAR tmpParentProcessName = PsGetProcessImageFileName(pParentEprocess);
            if (strlen(tmpParentProcessName) != 0)
            {
                RtlZeroMemory(pDeviceExten->szParentProcessName, MAX_PATH);
                RtlCopyMemory(pDeviceExten->szParentProcessName, tmpParentProcessName, strlen(tmpParentProcessName));
                //pDeviceExten->szParentProcessName[strlen(tmpParentProcessName) + 1] = '\0';
            }   
        }
        ANSI_STRING asProcessName;
        if (RtlUnicodeStringToAnsiString(&asProcessName, CreateInfo->ImageFileName, TRUE) == STATUS_SUCCESS)
        {
            RtlZeroMemory(pDeviceExten->szProcessName, MAX_PATH);
            RtlCopyMemory(pDeviceExten->szProcessName, asProcessName.Buffer,asProcessName.Length);
            //pDeviceExten->szProcessName[asProcessName.Length + 1] = '\0';
        }
        KeSetEvent(pDeviceExten->pkProcessEvent, 0, FALSE);
        KeResetEvent(pDeviceExten->pkProcessEvent);
    }
}