EtwpGetSidExtendedHeaderItem

VOID __stdcall EtwpGetSidExtendedHeaderItem(_ETW_SID_EXTENDED_DATA_ITEM *SidItem){
  _ETHREAD *CurrentThread; 
  _ADAPTER_OBJECT *v3; 
  _TOKEN_TYPE v4; 
  _ADAPTER_OBJECT *v5; 
  int v6; 
  size_t v7; 
  unsigned int v8; 
  unsigned int v9; 
  char EffectiveOnly[4]; 
  _TOKEN_TYPE TokenType; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; 
  UINT64 RequiredLength[10]; 

  EffectiveOnly[0] = 0;
  ImpersonationLevel = SecurityAnonymous;
  memset(RequiredLength, 0, 72);
  TokenType = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = (_ADAPTER_OBJECT *)PsReferenceEffectiveToken(
                            CurrentThread,
                            &TokenType,
                            (UINT8 *)EffectiveOnly,
                            &ImpersonationLevel,
                            0i64);
  v4 = TokenType;
  v5 = v3;
  if( TokenType == TokenImpersonation && ImpersonationLevel < SecurityImpersonation )
  {
    if( v3 )
      HalPutDmaAdapter(v3);
    v5 = (_ADAPTER_OBJECT *)PsReferencePrimaryToken(CurrentThread->Tcb.Process);
    v4 = TokenPrimary;
  }
  SeQueryUserSidToken(v5, (char *)RequiredLength + 4, 0x44ui64, RequiredLength);
  if( v4 == TokenPrimary )
  {
    ObFastDereferenceObject(&CurrentThread->Tcb.Process->Token, v5);
  }
  else if( v5 )
  {
    HalPutDmaAdapter(v5);
  }
  v6 = RequiredLength[0];
  v7 = RequiredLength[0];
  *(_DWORD *)&SidItem->Header.ExtType = 2;
  SidItem->Header.DataSize = v6;
  v8 = v6 + 8;
  v9 = (v6 + 15) & 0xFFFFFFF8;
  SidItem->Header.Size = (v6 + 15) & 0xFFF8;
  memmove(&SidItem->Sid, (char *)RequiredLength + 4, v7);
  memset((char *)SidItem + v8, 0i64, v9 - v8);
}

Referenced by: