SeCaptureSubjectContextEx

VOID *__stdcall SeCaptureSubjectContextEx(PETHREAD Thread, PEPROCESS Process, PSECURITY_SUBJECT_CONTEXT SubjectContext){
  void *v6; 
  _EX_FAST_REF *p_Token; 
  VOID *result; 
  _QWORD *v9; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v11; 
  _EX_PUSH_LOCK *p_ProcessLock; 

  SubjectContext->ProcessAuditId = Process->UniqueProcessId;
  if( Thread )
  {
    if( (Thread->CrossThreadFlags & 8) != 0 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockSharedEx(&Thread->ThreadLock, 0i64);
      if( (Thread->CrossThreadFlags & 8) != 0 )
      {
        v6 = (void *)(Thread->ClientSecurity.ImpersonationData & 0xFFFFFFFFFFFFFFF8ui64);
        ObfReferenceObject(v6);
        SubjectContext->ImpersonationLevel = Thread->ClientSecurity.ImpersonationData & 3;
      }
      else
      {
        v6 = 0i64;
      }
      if( _InterlockedCompareExchange64(&Thread->ThreadLock._bf_0, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(&Thread->ThreadLock);
      KeAbPostRelease(&Thread->ThreadLock);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    }
    else
    {
      v6 = 0i64;
    }
  }
  else
  {
    v6 = 0i64;
  }
  SubjectContext->ClientToken = v6;
  p_Token = &Process->Token;
  result = ObFastReferenceObject(&Process->Token);
  v9 = result;
  if( !result )
  {
    v11 = (_ETHREAD *)KeGetCurrentThread();
    --v11->Tcb.KernelApcDisable;
    p_ProcessLock = &Process->ProcessLock;
    ExAcquirePushLockSharedEx(p_ProcessLock, 0i64);
    v9 = ObFastReferenceObjectLocked(p_Token);
    if( _InterlockedCompareExchange64(&p_ProcessLock->_bf_0, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(p_ProcessLock);
    KeAbPostRelease(p_ProcessLock);
    KeLeaveCriticalRegionThread(&v11->Tcb);
  }
  SubjectContext->PrimaryToken = v9;
  if( SeTokenLeakTracking )
  {
    if( v9 )
    {
      _InterlockedIncrement((volatile signed __int32 *)(v9[143] + 284i64));
      if( SubjectContext->PrimaryToken == (void *)SepTokenLeakToken )
        __debugbreak();
    }
    result = SubjectContext->ClientToken;
    if( SubjectContext->ClientToken )
    {
      _InterlockedIncrement((volatile signed __int32 *)(*((_QWORD *)result + 143) + 284i64));
      result = (VOID *)SepTokenLeakToken;
      if( SubjectContext->ClientToken == (void *)SepTokenLeakToken )
        __debugbreak();
    }
  }
  return result;
}

Referenced by: