NtOpenProcessTokenEx

NTSTATUS __fastcall NtOpenProcessTokenEx(UINT64 a1, INT64 a2, INT64 a3, UINT64 a4){
  _ACCESS_MASK v5; 
  char PreviousMode; 
  int v7; 
  unsigned int v8; 
  UINT64 v9; 
  NTSTATUS result; 
  VOID *v11; 
  _EX_FAST_REF *v12; 
  _ADAPTER_OBJECT *v13; 
  int v14; 
  _EX_PUSH_LOCK *v15; 
  UINT64 Tag; 
  _KPROCESSOR_MODE Object; 
  PVOID v18; 
  VOID *Handle; 
  _KTHREAD *Thread; 

  v5 = a2;
  Handle = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v7 = 73714;
  if( PreviousMode )
    v7 = 7666;
  v8 = a3 & v7;
  if( PreviousMode )
  {
    v9 = a4;
    if( a4 >= 0x7FFFFFFF0000i64 )
      v9 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v9 = *(_QWORD *)v9;
  }
  v18 = 0i64;
  LODWORD(Tag) = 1699967824;
  result = ObpReferenceObjectByHandleWithTag(
             (VOID *)a1,
             0x1000ui64,
             (_OBJECT_TYPE *)PsProcessType,
             KeGetCurrentThread()->PreviousMode,
             Tag,
             &v18,
             0i64,
             0i64);
  if( result >= 0 )
  {
    v11 = v18;
    v12 = (_EX_FAST_REF *)((char *)v18 + 1208);
    v13 = (_ADAPTER_OBJECT *)ObFastReferenceObject((_EX_FAST_REF *)v18 + 151);
    if( !v13 )
    {
      Thread = (_ETHREAD *)KeGetCurrentThread();
      --Thread->Tcb.KernelApcDisable;
      v15 = (_EX_PUSH_LOCK *)((char *)v18 + 1080);
      ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)v18 + 135, 0i64);
      v13 = (_ADAPTER_OBJECT *)ObFastReferenceObjectLocked(v12);
      if( _InterlockedCompareExchange64(&v15->_bf_0, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v15);
      KeAbPostRelease(v15);
      KeLeaveCriticalRegionThread(&Thread->Tcb);
      v11 = v18;
    }
    ObfDereferenceObjectWithTag(v11, 0x65537350ui64);
    LOBYTE(Object) = PreviousMode;
    v14 = ObOpenObjectByPointer(v13, v8, 0i64, v5, (POBJECT_TYPE)SeTokenObjectType, Object, &Handle);
    HalPutDmaAdapter(v13);
    if( v14 >= 0 )
      *(_QWORD *)a4 = Handle;
    return v14;
  }
  return result;
}

Referenced by: