NtAlpcImpersonateClientContainerOfPort

NTSTATUS __stdcall NtAlpcImpersonateClientContainerOfPort(PVOID PortHandle, _PORT_MESSAGE *PortMessage, UINT64 Flags){
  _ETHREAD *CurrentThread; 
  NTSTATUS v5; 
  KPROCESSOR_MODE v6; 
  INT64 v7; 
  _ETHREAD *v8; 
  __int64 WorkOnBehalfThread; 
  _ETHREAD *v10; 
  __int64 v11; 
  _ETHREAD *v12; 
  __int64 v13; 
  _ALPC_WORK_ON_BEHALF_TICKET *v14; 
  int v16[2]; 
  ULONG_PTR BugCheckParameter2; 
  PVOID Object; 
  _ALPC_WORK_ON_BEHALF_TICKET Ticket; 
  PADAPTER_OBJECT DmaAdapter; 
  unsigned int a3; 
  unsigned int a2; 
  a3 = 0;
  v16[0] = 0;
  BugCheckParameter2 = 0i64;
  a2 = 0;
  Ticket = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  DmaAdapter = 0i64;
  if( (_DWORD)Flags )
  {
    v5 = -1073741811;
  }
  else
  {
    AlpcpCaptureIdMessage((INT64)PortMessage, &a2, &a3);
    v6 = *((_BYTE *)KeGetCurrentThread() + 562);
    Object = 0i64;
    v5 = ObReferenceObjectByHandle(PortHandle, 0x20000u, AlpcPortObjectType, v6, &Object, 0i64);
    DmaAdapter = (PADAPTER_OBJECT)Object;
    if( v5 >= 0 )
    {
      if( (*((_BYTE *)Object + 416) & 6) == 6 && *((_QWORD *)KeGetCurrentThread() + 23) == *((_QWORD *)Object + 3) )
      {
        v5 = AlpcpLookupMessage((INT64)Object, a2, a3, v7, &BugCheckParameter2);
        v16[1] = v5;
        if( v5 >= 0 )
        {
          if( (*(_DWORD *)(BugCheckParameter2 + 40) & 0x80u) == 0 )
          {
            v8 = *(_ETHREAD **)(BugCheckParameter2 + 32);
            if( v8 )
            {
              WorkOnBehalfThread = PsGetWorkOnBehalfThread(*(_QWORD *)(BugCheckParameter2 + 32), v16);
              v10 = (_ETHREAD *)WorkOnBehalfThread;
              if( WorkOnBehalfThread )
              {
                PsImpersonateContainerOfThread(WorkOnBehalfThread);
                if( v16[0] )
                  ObDereferenceObjectDeferDelete(v10);
              }
              else
              {
                IoThreadToProcess(v8);
                if( *(_QWORD *)(v11 + 2392) || PoEnergyEstimationEnabled() )
                {
                  v10 = v8;
                  PsImpersonateContainerOfThread((__int64)v8);
                }
                else
                {
                  v10 = 0i64;
                }
              }
              if( v10 )
              {
                v12 = (_ETHREAD *)KeGetCurrentThread();
                if( (*((_DWORD *)v12 + 29) & 0x400) != 0 || *((_BYTE *)v12 + 586) == 1 )
                  v13 = 0i64;
                else
                  v13 = *((_QWORD *)v12 + 30);
                if( v13 )
                {
                  PsEncodeThreadWorkOnBehalfTicket(v10, &Ticket);
                  v14[87] = Ticket;
                }
              }
            }
            AlpcpUnlockMessage(BugCheckParameter2);
          }
          else
          {
            AlpcpUnlockMessage(BugCheckParameter2);
            v5 = -1073740029;
          }
        }
      }
      else
      {
        v5 = -1073741790;
      }
    }
  }
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return v5;
}

Referenced by: