PspWriteTebImpersonationInfo

INT64 __stdcall PspWriteTebImpersonationInfo(_ETHREAD *Thread, _ETHREAD *CurrentThread){
  _DWORD *v4; 
  __int64 v5; 
  int v6; 
  bool v7; 
  _BOOL8 v8; 
  __int64 v9; 
  __int16 v10; 
  int v12[8]; 
  char v13; 
  bool v14; 
  _DWORD *v15; 
  __int64 v16; 
  _ETHREAD *v17; 
  _KAPC_STATE ApcState; 
  v17 = Thread;
  memset(&ApcState, 0, sizeof(ApcState));
  v4 = (_DWORD *)*((_QWORD *)Thread + 30);
  v15 = v4;
  if( v4 && (*((_DWORD *)Thread + 29) & 0x400) == 0 )
  {
    v5 = *((_QWORD *)Thread + 68);
    v16 = v5;
    if( *((_QWORD *)CurrentThread + 23) == v5 )
    {
      v13 = 0;
    }
    else
    {
      KiStackAttachProcess((_KPROCESS *)v5, 0i64, &ApcState);
      v13 = 1;
    }
    if( Thread == CurrentThread || ExAcquireRundownProtection((PEX_RUNDOWN_REF)Thread + 159) )
    {
      do
      {
        v6 = *((_DWORD *)Thread + 324) & 8;
        v7 = v6 != 0;
        v14 = v6 != 0;
        v8 = v6 != 0;
        v4[1511] = v8;
        v4[1530] = 0;
        v9 = *(_QWORD *)(v5 + 1408);
        if( v9 )
        {
          v10 = *(_WORD *)(v9 + 8);
          if( v10 == 332 || v10 == 452 )
          {
            v4[3047] = v8;
            v4[3057] = 0;
          }
        }
        _InterlockedOr(v12, 0);
      }
      while( v7 != ((*((_DWORD *)Thread + 324) & 8) != 0) );
      if( Thread != CurrentThread )
        ExReleaseRundownProtection((PEX_RUNDOWN_REF)Thread + 159);
    }
    if( v13 )
      KiUnstackDetachProcess(&ApcState, 0i64);
  }
  return 0i64;
}

Referenced by: