SeCaptureAtomTableCallout

NTSTATUS __stdcall SeCaptureAtomTableCallout(){
  _QWORD *v0; 
  _QWORD *v1; 
  _EJOB *volatile Job; 
  UINT8 v4; 
  int v5; 
  int v6; 
  signed __int64 Parameters; 

  Parameters = 0i64;
  v4 = 0;
  v0 = PsReferenceEffectiveToken(
         (_ETHREAD *)KeGetCurrentThread(),
         (_TOKEN_TYPE *)&v6,
         &v4,
         (_SECURITY_IMPERSONATION_LEVEL *)&v5,
         0i64);
  v1 = v0;
  if( (v0[25] & 0x4000) != 0 && !*(_QWORD *)(v0[135] + 48i64) )
  {
    Job = KeGetCurrentThread()->ApcState.Process->Job;
    if( !Job || (*((_DWORD *)Job + 112) & 0x20) == 0 )
    {
      PsInvokeWin32Callout(Win32GlobalAtomTableCallout, &Parameters, PsWin32SessionAttachNone, 0i64);
      if( Parameters && !_InterlockedCompareExchange64((volatile signed __int64 *)(v1[135] + 48i64), Parameters, 0i64) )
        _InterlockedIncrement((volatile signed __int32 *)(Parameters + 4));
    }
  }
  return ObfDereferenceObjectWithTag(v1, 0x746C6644ui64);
}

Referenced by: