NtAlpcImpersonateClientContainerOfPort

NTSTATUS __fastcall NtAlpcImpersonateClientContainerOfPort(VOID *PortHandle, _PORT_MESSAGE *PortMessage, UINT64 Flags){
  _ETHREAD *CurrentThread; 
  int v5; 
  char PreviousMode; 
  _KALPC_MESSAGE **v7; 
  _ETHREAD *WaitingThread; 
  _ETHREAD *WorkOnBehalfThread; 
  _ETHREAD *v10; 
  _ETHREAD *v11; 
  void *Teb; 
  _ALPC_WORK_ON_BEHALF_TICKET *v13; 
  UINT64 DerefThread; 
  _KALPC_MESSAGE *Message; 
  PVOID Object; 
  _ALPC_WORK_ON_BEHALF_TICKET Ticket; 
  PADAPTER_OBJECT DmaAdapter; 
  UINT64 CallbackId; 
  UINT64 MessageId; 

  LODWORD(CallbackId) = 0;
  LODWORD(DerefThread) = 0;
  Message = 0i64;
  LODWORD(MessageId) = 0;
  Ticket = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  DmaAdapter = 0i64;
  if( (_DWORD)Flags )
  {
    v5 = -1073741811;
  }
  else
  {
    AlpcpCaptureIdMessage((PORT_MESSAGE *)&PortMessage->u1.DataLength, &MessageId, &CallbackId);
    PreviousMode = KeGetCurrentThread()->PreviousMode;
    Object = 0i64;
    v5 = ObReferenceObjectByHandle(PortHandle, 0x20000ui64, AlpcPortObjectType, PreviousMode, &Object, 0i64);
    DmaAdapter = (PADAPTER_OBJECT)Object;
    if( v5 >= 0 )
    {
      if( (*((_BYTE *)Object + 416) & 6) == 6
        && KeGetCurrentThread()->ApcState.Process == (_EPROCESS *)*((_QWORD *)Object + 3) )
      {
        v5 = AlpcpLookupMessage((_ALPC_PORT *)Object, (unsigned int)MessageId, (unsigned int)CallbackId, v7);
        HIDWORD(DerefThread) = v5;
        if( v5 >= 0 )
        {
          if( (Message->u1.State & 0x80u) == 0 )
          {
            WaitingThread = Message->WaitingThread;
            if( WaitingThread )
            {
              WorkOnBehalfThread = PsGetWorkOnBehalfThread((VOID **)Message->WaitingThread, &DerefThread);
              v10 = WorkOnBehalfThread;
              if( WorkOnBehalfThread )
              {
                PsImpersonateContainerOfThread(WorkOnBehalfThread);
                if( (_DWORD)DerefThread )
                  ObDereferenceObjectDeferDelete((UINT64)v10);
              }
              else if( IoThreadToProcess(WaitingThread)->DiskIoAttribution || PoEnergyEstimationEnabled() )
              {
                v10 = WaitingThread;
                PsImpersonateContainerOfThread(WaitingThread);
              }
              else
              {
                v10 = 0i64;
              }
              if( v10 )
              {
                v11 = (_ETHREAD *)KeGetCurrentThread();
                if( (v11->Tcb._bf_0 & 0x400) != 0 || v11->Tcb.ApcStateIndex == 1 )
                  Teb = 0i64;
                else
                  Teb = v11->Tcb.Teb;
                if( Teb )
                {
                  PsEncodeThreadWorkOnBehalfTicket(v10, &Ticket);
                  v13[87] = Ticket;
                }
              }
            }
            AlpcpUnlockMessage(Message);
          }
          else
          {
            AlpcpUnlockMessage(Message);
            v5 = -1073740029;
          }
        }
      }
      else
      {
        v5 = -1073741790;
      }
    }
  }
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v5;
}

Referenced by: