PspReferenceTokenForNewProcess

NTSTATUS __stdcall PspReferenceTokenForNewProcess(
        _EPROCESS *ParentProcess,
        VOID *TokenHandle,
        _KPROCESSOR_MODE PreviousMode,
        VOID **NewToken){
  PVOID v5; 
  NTSTATUS result; 
  PVOID Object; 

  if( !TokenHandle )
  {
    if( ParentProcess )
    {
      v5 = PsReferencePrimaryToken(ParentProcess);
    }
    else
    {
      v5 = PspBootAccessToken;
      ObfReferenceObject(PspBootAccessToken);
    }
    goto LABEL_4;
  }
  Object = 0i64;
  result = ObReferenceObjectByHandle(TokenHandle, 1ui64, (_OBJECT_TYPE *)SeTokenObjectType, PreviousMode, &Object, 0i64);
  v5 = Object;
  if( result >= 0 )
  {
LABEL_4:
    *NewToken = v5;
    return 0;
  }
  return result;
}

Referenced by: