RtlReleasePrivilege

VOID __stdcall RtlReleasePrivilege(VOID *StatePointer){
  int v2; 
  __int64 v3; 
  char *v4; 

  v2 = *((_DWORD *)StatePointer + 8);
  if( (v2 & 3) != 1 )
  {
    ZwAdjustPrivilegesToken(*(_QWORD *)StatePointer, 0, *((_QWORD *)StatePointer + 2), 0i64, 0i64, 0i64);
    v2 = *((_DWORD *)StatePointer + 8);
  }
  if( (v2 & 1) != 0 )
  {
    ZwSetInformationThread(0xFFFFFFFFFFFFFFFEui64, 5i64, (UINT64)StatePointer + 8, 8ui64);
    v3 = *((_QWORD *)StatePointer + 1);
    if( v3 )
      ZwClose(v3);
  }
  v4 = (char *)*((_QWORD *)StatePointer + 2);
  if( v4 != (char *)StatePointer + 36 )
    ExFreePoolWithTag(v4, 0);
  ZwClose(*(_QWORD *)StatePointer);
  ExFreePoolWithTag(StatePointer, 0);
}

Referenced by: