SeCreateClientSecurity

NTSTATUS __stdcall SeCreateClientSecurity(
        _ETHREAD *ClientThread,
        PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos,
        BOOLEAN RemoteSession,
        PSECURITY_CLIENT_CONTEXT ClientContext){
  _ETHREAD *CurrentThread; 
  __int64 v8; 
  _TOKEN *v9; 
  _TOKEN_TYPE v10; 
  bool v11; 
  NTSTATUS result; 
  NTSTATUS v13; 
  INT64 ThreadEffectiveOnly; 
  INT64 ReturnAnonymous; 
  BOOL UsePrimaryTrust; 
  char ImpersonationLevel[12]; 
  BYTE v18; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  LOWORD(UsePrimaryTrust) = 0;
  memset(ImpersonationLevel, 0, sizeof(ImpersonationLevel));
  v18 = 0;
  if( ClientThread == CurrentThread )
    v8 = *((_QWORD *)CurrentThread + 23);
  else
    v8 = *((_QWORD *)ClientThread + 68);
  v9 = (_TOKEN *)PsReferenceImpersonationTokenEx(
                   (INT64)ClientThread,
                   0,
                   (BYTE *)&UsePrimaryTrust + 2,
                   &UsePrimaryTrust,
                   (INT64 *)ImpersonationLevel,
                   &v18);
  if( v9 )
  {
    v11 = UsePrimaryTrust;
    v10 = TokenImpersonation;
  }
  else
  {
    v9 = (_TOKEN *)ObFastReferenceObject((INT64 *)(v8 + 1208));
    if( !v9 )
    {
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockSharedEx(v8 + 1080, 0i64);
      v9 = (_TOKEN *)ObFastReferenceObjectLocked((_EX_FAST_REF *)(v8 + 1208));
      if( _InterlockedCompareExchange64((volatile signed __int64 *)(v8 + 1080), 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((INT64 *)(v8 + 1080));
      KeAbPostRelease((PVOID)(v8 + 1080));
      KeLeaveCriticalRegionThread((__int64)CurrentThread);
    }
    v10 = TokenPrimary;
    v18 = *(_BYTE *)(v8 + 2170);
    v11 = 0;
  }
  SepReconcileTrustSidWithProcessProtection(
    v9->TrustLevelSid,
    (_PS_PROTECTION *)&v18,
    (UINT8 *)&UsePrimaryTrust + 1,
    (VOID **)&ImpersonationLevel[4]);
  LOBYTE(ReturnAnonymous) = 0;
  LOBYTE(ThreadEffectiveOnly) = v11;
  result = SepCreateClientSecurityEx(
             v9,
             ClientSecurityQos,
             RemoteSession,
             v10,
             ThreadEffectiveOnly,
             *(_SECURITY_IMPERSONATION_LEVEL *)ImpersonationLevel,
             ReturnAnonymous,
             0i64,
             BYTE1(UsePrimaryTrust),
             *(VOID **)&ImpersonationLevel[4],
             ClientContext);
  v13 = result;
  if( result < 0 || !ClientSecurityQos->ContextTrackingMode )
  {
    HalPutDmaAdapter((PADAPTER_OBJECT)v9);
    return v13;
  }
  return result;
}

Referenced by: