IoReferenceIoAttributionFromThread

NTSTATUS __stdcall IoReferenceIoAttributionFromThread(_ETHREAD *Thread, PVOID *OpaqueContext){
  _ETHREAD *WorkOnBehalfThread; 
  UINT64 v5; 
  _EPROCESS *Process; 
  NTSTATUS v7; 
  UINT64 v9; 

  LODWORD(v9) = 0;
  WorkOnBehalfThread = PsGetWorkOnBehalfThread((VOID **)Thread, &v9);
  v5 = (UINT64)WorkOnBehalfThread;
  if( WorkOnBehalfThread )
    Process = WorkOnBehalfThread->Tcb.Process;
  else
    Process = Thread->Tcb.Process;
  v7 = IopReferenceIoAttributionFromProcess(Process, 0, OpaqueContext);
  if( (_DWORD)v9 )
    ObDereferenceObjectDeferDelete(v5);
  return v7;
}

Referenced by: