SeCaptureSubjectContext

NTSTATUS __fastcall SeCaptureSubjectContext(INT64 a1){
  _ETHREAD *CurrentThread; 
  _EX_FAST_REF *Process; 
  VOID *v4; 
  _EX_FAST_REF *v5; 
  _QWORD *v6; 
  _QWORD *v7; 
  _ETHREAD *v8; 
  _EX_PUSH_LOCK *v9; 
  UINT8 v11; 
  UINT8 v12; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = (_EX_FAST_REF *)CurrentThread->Tcb.ApcState.Process;
  v12 = 0;
  v11 = 0;
  *(_EX_FAST_REF *)(a1 + 24) = Process[136];
  if( CurrentThread )
    v4 = PsReferenceImpersonationTokenEx(
           CurrentThread,
           0i64,
           &v12,
           &v11,
           (_SECURITY_IMPERSONATION_LEVEL *)(a1 + 8),
           0i64);
  else
    v4 = 0i64;
  v5 = Process + 151;
  *(_QWORD *)a1 = v4;
  v6 = ObFastReferenceObject(Process + 151);
  v7 = v6;
  if( !v6 )
  {
    v8 = (_ETHREAD *)KeGetCurrentThread();
    --v8->Tcb.KernelApcDisable;
    v9 = (_EX_PUSH_LOCK *)&Process[135];
    ExAcquirePushLockSharedEx(v9, 0i64);
    v7 = ObFastReferenceObjectLocked(v5);
    if( _InterlockedCompareExchange64(&v9->_bf_0, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v9);
    KeAbPostRelease(v9);
    KeLeaveCriticalRegionThread(&v8->Tcb);
  }
  *(_QWORD *)(a1 + 16) = v7;
  if( SeTokenLeakTracking )
  {
    if( v7 )
    {
      _InterlockedIncrement((volatile signed __int32 *)(v7[143] + 284i64));
      if( *(_QWORD *)(a1 + 16) == SepTokenLeakToken )
        __debugbreak();
    }
    v6 = *(_QWORD **)a1;
    if( *(_QWORD *)a1 )
    {
      _InterlockedIncrement((volatile signed __int32 *)(v6[143] + 284i64));
      LODWORD(v6) = SepTokenLeakToken;
      if( *(_QWORD *)a1 == SepTokenLeakToken )
        __debugbreak();
    }
  }
  return(int)v6;
}

Referenced by: