SeCaptureAtomTableCallout

VOID __stdcall SeCaptureAtomTableCallout(INT64 Parameters, INT64 a2){
  _QWORD *v2; 
  _QWORD *v3; 
  __int64 v4; 
  UINT8 v5; 
  int v6; 
  int v7; 
  signed __int64 v8; 
  v8 = 0i64;
  v5 = 0;
  v2 = PsReferenceEffectiveToken(
         (_ETHREAD *)KeGetCurrentThread(),
         (_TOKEN_TYPE *)&v7,
         &v5,
         (_SECURITY_IMPERSONATION_LEVEL *)&v6,
         0i64);
  v3 = v2;
  if( (v2[25] & 0x4000) != 0 && !*(_QWORD *)(v2[135] + 48i64) )
  {
    v4 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1296i64);
    if( !v4 || (*(_DWORD *)(v4 + 448) & 0x20) == 0 )
    {
      PsInvokeWin32Callout(2i64, &v8, 0i64, 0i64);
      if( v8 && !_InterlockedCompareExchange64((volatile signed __int64 *)(v3[135] + 48i64), v8, 0i64) )
        _InterlockedIncrement((volatile signed __int32 *)(v8 + 4));
    }
  }
  ObfDereferenceObjectWithTag(v3, 0x746C6644ui64);
}

Referenced by: