KernelExplorer without driver

GetSidIdentifierAuthority(ppSidGroup);
GetSidSubAuthorityCount(ppSidGroup);
GetSidSubAuthority(ppSidGroup, i);
GetLengthSid(ppSidGroup);

// For Windows 7
BYTE pattren_GetSecurityInfoEx_Win7[68] = {
    0x48,0x8B,0xC4,0x4C,0x89,0x48,0x20,0x44,0x89,0x40,0x18,0x89,0x50,0x10,0x48,0x89,
    0x48,0x08,0x53,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x83,0xEC,0x68,
    0x45,0x8B,0xE0,0x48,0x8B,0xF9,0x48,0x8D,0x00,0x00,0x00,0x00,0x00,0xE8,0x00,0x00,
    0x00,0x00,0x8B,0xD8,0x85,0xC0,0x0F,0x85,0x00,0x00,0x00,0x00,0x48,0x85,0xFF,0x75,
    0x08,0x8D,0x5F,0x06
}; _TPCCH mask_GetSecurityInfoEx_Win7 = _TEXT("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx?????x????xxxxxx????xxxxxxxx");
 
// For Windows 10
BYTE pattren_GetSecurityInfoEx_Win10[64] = {
    0x48,0x8B,0xC4,0x4C,0x89,0x48,0x20,0x44,0x89,0x40,0x18,0x89,0x50,0x10,0x48,0x89,
    0x48,0x08,0x53,0x56,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x83,0xEC,
    0x60,0x45,0x8B,0xF0,0x48,0x8B,0xF1,0xE8,0x00,0x00,0x00,0x00,0x8B,0xD8,0x33,0xFF,
    0x85,0xC0,0x0F,0x85,0x00,0x00,0x00,0x00,0x48,0x85,0xF6,0x75,0x08,0x8D,0x58,0x06
}; _TPCCH mask_GetSecurityInfoEx_Win10 = _TEXT("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx????xxxxxxxx????xxxxxxxx");

Sys_GetSecurityDescriptor(
    ppProcessSidOwner, ppProcessSidGroup, ppProcessDacl, ppProcessSacl, ppProcessSecurityDescriptor,    // from GetSecurityInfo
    ppProcessAccessList, ppProcessAuditList, ppProcessOwner, ppProcessGroup                     // from GetSecurityInfoEx
)

_TCHAR UserName[MAX_PATH]{};
DWORD pcbBuffer = 260;
GetUserName(UserName, &pcbBuffer);

__int64 __fastcall PrimaryTerminalAndHookWorker(
    HWINSTA* s_hWinsta,
    HDESK* s_hdeskWinlogon,
    HDESK* s_hdeskApplication,
    __int64 g_Context,
    PWORD g_usState,
    __int16 a6, // = 6
    PWORD v63,
    PSID g_pSidSystem,
    PSID g_pSidLocalService,
    PSID g_pSidLocal,
    PSID g_pSidWorld,
    PSID g_pSidAdmin,
    PSID g_pSidPowerUser,
    PSID g_pSidCreator,
    PSID g_pSidRestricted,
    PSID g_pSidInteractive,
    PSID g_pSidService,
    PSID g_pSidWindowManager,
    PSID g_pSidFontDriverHost,
    PSID g_pSidAnyPackage,
    PSID g_pSidAnyRestrictedPackage
)
{
    WMsgClntInitialize((struct WI_GLOBAL_CONTEXT*)&g_Context, 1);
 
    LPVOID lpMem[5]{};
 
    __int64 result = CreatePrimaryTerminal(s_hWinsta, lpMem, s_hdeskWinlogon, s_hdeskApplication, g_Context);
 
    if ((DWORD)result) {
        *v63 = 1;
    }
 
    else {
        *g_usState = a6;
        HeapFree(GetProcessHeap(), 0, lpMem[0]);
        UpdatePerUserSystemParameters(0);
        result = 0;
    }
 
    return result;
}

__int64 __fastcall CreatePrimaryTerminal(
    HWINSTA* hWinsta,
    LPVOID* lpMem,
    HDESK* hdeskWinlogon,
    HDESK* hdeskApplication,
    __int64 g_Context
) 
{
    __int64 v39 = 0;
 
    if (RegisterLogonProcess(NtCurrentTeb()->ClientId.UniqueProcess, TRUE)) {
        HWINSTA v10 = CreateWindowStationW(L"WinSta0", 0, 0x2000000, 0);
        SetProcessWindowStation(v10);
        HDESK v17 = CreateDesktopW(L"Winlogon", 0, 0, 0, 0x2000000, 0);
        if (v17) {
            HDESK v18 = CreateDesktopW(L"Default", 0, 0, 0, 0x2000000, 0);
            SwitchDesktop(v17);
            SetThreadDesktop(v17);
            SetWindowStationUser(*v10, &v39, 0, 0);
            CreateThread(0, 0, LaunchUmfdHostWithVirtualAccountThreadProc, 0, 0, 0);
        }
    }
 
}

__int64 __fastcall WMsgClntInitialize(struct WI_GLOBAL_CONTEXT* a1, int a2)
{
    SIZE_T v5[9]{};
    DWORD v2 = NO_ERROR;
 
    if (a2) {
        v5[0] = WMsgMessageHandler;
        v5[1] = WMsgMessageHandler;
        v5[5] = WMsgNotifyHandler;
        v5[2] = WMsgPSPHandler;
        v5[6] = WMsgBroadcastMessageHandler;
        v5[7] = WMsgBroadcastNotifyHandler;
 
        RegisterWMsgServer(v5);
        v2 = StartWMsgKServer(v3); // ncalrpc
}

void UIStartupWorker()
{
    return 0;
}