NtImpersonateThread

NTSTATUS __stdcall NtImpersonateThread(
        VOID *ServerThreadHandle,
        VOID *ClientThreadHandle,
        _SECURITY_QUALITY_OF_SERVICE *SecurityQos,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  char PreviousMode; 
  NTSTATUS result; 
  int v13; 
  _ADAPTER_OBJECT *v14; 
  PVOID Object; 
  _SECURITY_QUALITY_OF_SERVICE ClientSecurityQos; 
  _SECURITY_CLIENT_CONTEXT ClientContext; 
  PVOID v18; 

  *(_QWORD *)&ClientSecurityQos.Length = 0i64;
  *(_DWORD *)&ClientSecurityQos.ContextTrackingMode = 0;
  memset(&ClientContext, 0i64, sizeof(ClientContext));
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode && ((unsigned __int8)SecurityQos & 3) != 0 )
    ExRaiseDatatypeMisalignment();
  ClientSecurityQos = *SecurityQos;
  Object = 0i64;
  result = ObReferenceObjectByHandle(
             ClientThreadHandle,
             0x200ui64,
             (_OBJECT_TYPE *)PsThreadType,
             PreviousMode,
             &Object,
             0i64);
  if( result >= 0 )
  {
    v18 = 0i64;
    v13 = ObReferenceObjectByHandle(
            ServerThreadHandle,
            0x100ui64,
            (_OBJECT_TYPE *)PsThreadType,
            PreviousMode,
            &v18,
            0i64);
    v14 = (_ADAPTER_OBJECT *)Object;
    if( v13 >= 0 )
    {
      v13 = SeCreateClientSecurity((PETHREAD)Object, &ClientSecurityQos, 0, &ClientContext);
      if( v13 >= 0 )
      {
        v13 = SeImpersonateClientEx(&ClientContext, (PETHREAD)v18);
        HalPutDmaAdapter((PADAPTER_OBJECT)ClientContext.ClientToken);
      }
      HalPutDmaAdapter((PADAPTER_OBJECT)v18);
    }
    HalPutDmaAdapter(v14);
    return v13;
  }
  return result;
}

Referenced by: