PsEncodeThreadWorkOnBehalfTicket

VOID __stdcall PsEncodeThreadWorkOnBehalfTicket(_ETHREAD *Thread, _ALPC_WORK_ON_BEHALF_TICKET *Ticket){
  Ticket->ThreadId = (unsigned int)Thread->Cid.UniqueThread;
  Ticket->ThreadCreationTimeLow = Thread->CreateTime.anonymous_0.LowPart;
  *(_QWORD *)Ticket ^= PspWorkOnBehalfEncodingKey;
}

Referenced by:

AlpcpCaptureAttributes
AlpcpCaptureWorkOnBehalfAttribute
NtAlpcImpersonateClientContainerOfPort
NtQueryInformationThread