PsReferenceEffectiveToken

VOID *__stdcall PsReferenceEffectiveToken(
        _ETHREAD *Thread,
        _TOKEN_TYPE *TokenType,
        UINT8 *EffectiveOnly,
        _SECURITY_IMPERSONATION_LEVEL *ImpersonationLevel,
        PS_PROTECTION *ProcessProtection){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  void *v11; 
  VOID *v12; 
  _EX_PUSH_LOCK *Lock; 
  _KTHREAD *Threada; 
  _EPROCESS *v16; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( Thread == CurrentThread )
    Process = CurrentThread->Tcb.ApcState.Process;
  else
    Process = Thread->Tcb.Process;
  v11 = 0i64;
  if( (Thread->CrossThreadFlags & 8) == 0 )
    goto LABEL_4;
  v16 = Thread->Tcb.Process;
  Threada = (_ETHREAD *)KeGetCurrentThread();
  --Threada->Tcb.KernelApcDisable;
  Lock = &Thread->ThreadLock;
  ExAcquirePushLockSharedEx(&Thread->ThreadLock, 0i64);
  if( (Thread->CrossThreadFlags & 8) != 0 )
  {
    v11 = (void *)(Thread->ClientSecurity.ImpersonationData & 0xFFFFFFFFFFFFFFF8ui64);
    ObfReferenceObject(v11);
    *ImpersonationLevel = Thread->ClientSecurity.ImpersonationData & 3;
    *EffectiveOnly = (Thread->ClientSecurity._bf_0 & 4) != 0;
    if( ProcessProtection )
      ProcessProtection->Level = (unsigned __int8)v16->Protection;
  }
  if( _InterlockedCompareExchange64(&Lock->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(Lock);
  KeAbPostRelease(Lock);
  KeLeaveCriticalRegionThread(&Threada->Tcb);
  if( v11 )
  {
    *TokenType = TokenImpersonation;
    return v11;
  }
  else
  {
LABEL_4:
    v12 = ObFastReferenceObject(&Process->Token);
    if( !v12 )
    {
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockSharedEx(&Process->ProcessLock, 0i64);
      v12 = ObFastReferenceObjectLocked(&Process->Token);
      if( _InterlockedCompareExchange64(&Process->ProcessLock._bf_0, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(&Process->ProcessLock);
      KeAbPostRelease(&Process->ProcessLock);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    }
    *TokenType = TokenPrimary;
    *EffectiveOnly = 0;
    if( ProcessProtection )
      ProcessProtection->Level = (unsigned __int8)Process->Protection;
    return v12;
  }
}

Referenced by: