NtAlpcImpersonateClientOfPort

NTSTATUS __stdcall NtAlpcImpersonateClientOfPort(VOID *PortHandle, PORT_MESSAGE *PortMessage, VOID *Flags){
  _ADAPTER_OBJECT *v6; 
  _ETHREAD *CurrentThread; 
  char PreviousMode; 
  unsigned int v9; 
  unsigned __int64 v10; 
  unsigned int v11; 
  _BOOL4 v12; 
  _KALPC_MESSAGE **v13; 
  int v14; 
  _OBJECT_ATTRIBUTES *v15; 
  _KALPC_MESSAGE *v16; 
  _ALPC_PORT *v18; 
  PFILE_BASIC_INFORMATION *Object; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  UINT64 CallbackId; 
  INT64 v22; 
  PFILE_BASIC_INFORMATION FileInformation[2]; 
  _SECURITY_CLIENT_CONTEXT ClientContext; 
  PVOID v25; 
  UINT64 MessageId; 

  v6 = 0i64;
  FileInformation[0] = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  LODWORD(MessageId) = 0;
  LODWORD(CallbackId) = 0;
  v22 = 0i64;
  FileInformation[1] = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  LOBYTE(v25) = PreviousMode;
  if( PortMessage )
  {
    AlpcpCaptureIdMessage(PortMessage, &MessageId, &CallbackId);
    v9 = MessageId;
    if( !(_DWORD)MessageId )
    {
LABEL_28:
      v15 = (_OBJECT_ATTRIBUTES *)v22;
      v14 = -1073741811;
      goto LABEL_11;
    }
    PreviousMode = (char)v25;
  }
  else
  {
    v9 = MessageId;
  }
  v10 = (unsigned __int64)Flags >> 2;
  if( (unsigned int)((unsigned __int64)Flags >> 2) > 3 )
    goto LABEL_28;
  v11 = (unsigned __int8)Flags & 1;
  v12 = (((4 * (_DWORD)v10) | 2) & (unsigned int)Flags) != 0i64;
  v25 = 0i64;
  v14 = ObReferenceObjectByHandle(PortHandle, 1ui64, AlpcPortObjectType, PreviousMode, &v25, 0i64);
  v15 = (_OBJECT_ATTRIBUTES *)v25;
  if( v14 < 0 )
    goto LABEL_11;
  if( v9 )
  {
    Object = FileInformation;
    v14 = AlpcpLookupMessage((_ALPC_PORT *)v25, v9, (unsigned int)CallbackId, v13);
    if( v14 >= 0 )
    {
      LODWORD(Object) = v10;
      v16 = (_KALPC_MESSAGE *)FileInformation[0];
      v14 = AlpcpImpersonateMessage(
              v15,
              FileInformation[0],
              v11,
              v12,
              (INT64)Object,
              (INT64)HandleInformation,
              CallbackId,
              v22);
      if( AlpcpMessageLogEnabled )
        AlpcpEnterStateChangeEventMessageLog(v16);
      AlpcpUnlockBlob(v16);
    }
  }
  else
  {
    v18 = AlpcpReferenceConnectedPort((_ALPC_PORT *)v25);
    v6 = (_ADAPTER_OBJECT *)v18;
    if( !v18 )
    {
      v14 = -1073741790;
      goto LABEL_11;
    }
    if( (v18->PortAttributes.Flags & 0x10000) == 0 )
    {
      v14 = -1073741790;
      goto LABEL_11;
    }
    if( (v18->u1.State & 0x400) != 0 )
    {
      v14 = -1073741790;
      goto LABEL_11;
    }
    ClientContext = v18->StaticSecurity;
    if( v12 )
    {
      if( (int)v10 > ClientContext.SecurityQos.ImpersonationLevel )
      {
        v14 = -1073741790;
        goto LABEL_11;
      }
      ClientContext.SecurityQos.ImpersonationLevel = v10;
    }
    v14 = SeImpersonateClientEx(&ClientContext, 0i64);
  }
LABEL_11:
  if( v6 )
    HalPutDmaAdapter(v6);
  if( v15 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v15);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v14;
}

Referenced by: