PsImpersonateClient

INT64 __stdcall PsImpersonateClient(
        _ETHREAD *Thread,
        PVOID Token,
        UINT8 CopyOnOpen,
        UINT8 EffectiveOnly,
        _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel){
  _EX_FAST_REF *v5; 
  char v6; 
  unsigned __int64 v9; 
  struct _DMA_ADAPTER *v11; 
  struct _DMA_ADAPTER *v12; 
  _ETHREAD *CurrentThread; 
  char v14; 
  bool v15; 
  _ETHREAD *v16; 
  _EX_FAST_REF *v17; 
  struct DMA_ADAPTER *v18; 
  _SECURITY_IMPERSONATION_LEVEL v19; 
  CHAR v20; 
  char v21; 
  _ETHREAD *v22; 
  unsigned __int64 v23; 
  char v24; 
  VOID *ProcessTrustSid; 
  CHAR v27; 
  int v28; 
  _SECURITY_IMPERSONATION_LEVEL v29; 
  INT64 *v30; 
  PVOID TokenToBeLinked; 
  VOID *DuplicateToken; 
  UINT8 UseProcessTrust; 
  _ETHREAD *v34; 
  v5 = (_EX_FAST_REF *)*((_QWORD *)Thread + 68);
  v6 = 0;
  DuplicateToken = 0i64;
  UseProcessTrust = 0;
  v9 = (unsigned __int64)Token;
  TokenToBeLinked = 0i64;
  if( !Token )
  {
    v11 = 0i64;
    v12 = 0i64;
    if( (*((_DWORD *)Thread + 324) & 8) == 0 )
      return 0i64;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx((UINT64)Thread + 1280, 0i64);
    if( (*((_DWORD *)Thread + 324) & 8) != 0 )
    {
      v12 = (struct _DMA_ADAPTER *)*((_QWORD *)Thread + 183);
      v11 = (struct _DMA_ADAPTER *)(*((_QWORD *)Thread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
      *((_QWORD *)Thread + 183) = 0i64;
      _InterlockedAnd((volatile signed __int32 *)Thread + 324, 0xFFFFFFF7);
    }
    v14 = _InterlockedExchangeAdd64((volatile signed __int64 *)Thread + 160, 0xFFFFFFFFFFFFFFFFui64);
    if( (v14 & 2) != 0 && (v14 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)Thread + 160);
    KeAbPostRelease((char *)Thread + 1280);
    v15 = (*((_WORD *)CurrentThread + 242))++ == 0xFFFF;
    if( v15
      && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152)
      && !*((_WORD *)CurrentThread + 243) )
    {
      KiCheckForKernelApcDelivery();
    }
    v16 = CurrentThread;
LABEL_21:
    PspWriteTebImpersonationInfo(Thread, v16);
    if( v11 )
      HalPutDmaAdapter(v11);
    if( v12 )
      HalPutDmaAdapter(v12);
    return 0i64;
  }
  v17 = v5 + 151;
  v18 = (struct DMA_ADAPTER *)ObFastReferenceObject((INT64 *)&v5[151]);
  if( !v18 )
  {
    v34 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v34 + 242);
    v30 = (INT64 *)&v5[135];
    ExAcquirePushLockSharedEx((UINT64)v30, 0i64);
    v18 = (struct DMA_ADAPTER *)ObFastReferenceObjectLocked(v17);
    if( _InterlockedCompareExchange64(v30, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v30);
    KeAbPostRelease(v30);
    KeLeaveCriticalRegionThread((__int64)v34);
    if( !v18 )
    {
      v21 = ImpersonationLevel;
      goto LABEL_13;
    }
  }
  v19 = ImpersonationLevel;
  LODWORD(v34) = ImpersonationLevel;
  if( (int)SeTokenCanImpersonate(v18, (PVOID)v9, ImpersonationLevel, &UseProcessTrust) < 0 )
  {
    v15 = *(_DWORD *)(v9 + 192) == 2;
    v29 = SecurityIdentification;
    LODWORD(v34) = 1;
    if( v15 && *(int *)(v9 + 196) < 1 )
    {
      v29 = *(_DWORD *)(v9 + 196);
      LODWORD(v34) = v29;
    }
    v28 = SeCopyClientToken((VOID *)v9, v29, v20, 0, 0i64, &DuplicateToken);
    if( v28 >= 0 )
    {
      v9 = (unsigned __int64)DuplicateToken;
      v6 = 1;
      goto LABEL_12;
    }
  }
  else
  {
    if( !UseProcessTrust )
      goto LABEL_12;
    LODWORD(ProcessTrustSid) = SeQueryTokenTrustSid(v18);
    v28 = SeCopyClientToken((VOID *)v9, v19, v27, 1u, ProcessTrustSid, &TokenToBeLinked);
    if( v28 >= 0 )
    {
      if( CopyOnOpen )
      {
        SeSetTokenTrustLink(TokenToBeLinked, (PVOID)v9);
      }
      else
      {
        v9 = (unsigned __int64)TokenToBeLinked;
        TokenToBeLinked = 0i64;
        v6 = 1;
      }
LABEL_12:
      ObFastDereferenceObject((INT64 *)v17, v18);
      v15 = v6 == 0;
      v21 = (char)v34;
      if( !v15 )
      {
LABEL_14:
        v22 = (_ETHREAD *)KeGetCurrentThread();
        v23 = v9 & 0xFFFFFFFFFFFFFFF8ui64 | v21 & 3 | (4i64 * (EffectiveOnly & 1));
        --*((_WORD *)v22 + 242);
        ExAcquirePushLockExclusiveEx((UINT64)Thread + 1280, 0i64);
        if( (*((_DWORD *)Thread + 324) & 8) != 0 )
        {
          v12 = (struct _DMA_ADAPTER *)*((_QWORD *)Thread + 183);
          v11 = (struct _DMA_ADAPTER *)(*((_QWORD *)Thread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
        }
        else
        {
          v11 = 0i64;
          v12 = 0i64;
          _InterlockedOr((volatile signed __int32 *)Thread + 324, 8u);
        }
        *((_QWORD *)Thread + 183) = TokenToBeLinked;
        *((_QWORD *)Thread + 149) = v23;
        if( CopyOnOpen )
          _InterlockedOr((volatile signed __int32 *)Thread + 324, 0x100u);
        else
          _InterlockedAnd((volatile signed __int32 *)Thread + 324, 0xFFFFFEFF);
        v24 = _InterlockedExchangeAdd64((volatile signed __int64 *)Thread + 160, 0xFFFFFFFFFFFFFFFFui64);
        if( (v24 & 2) != 0 && (v24 & 4) == 0 )
          ExfTryToWakePushLock((volatile INT64 *)Thread + 160);
        KeAbPostRelease((char *)Thread + 1280);
        v15 = (*((_WORD *)v22 + 242))++ == 0xFFFF;
        if( v15 && *((_ETHREAD **)v22 + 19) != (_ETHREAD *)((char *)v22 + 152) && !*((_WORD *)v22 + 243) )
          KiCheckForKernelApcDelivery();
        v16 = v22;
        goto LABEL_21;
      }
LABEL_13:
      ObfReferenceObject((PVOID)v9);
      goto LABEL_14;
    }
  }
  ObFastDereferenceObject((INT64 *)v17, v18);
  return(unsigned int)v28;
}

Referenced by: