SeCaptureSubjectContextEx

VOID __stdcall SeCaptureSubjectContextEx(
        _ETHREAD *Thread,
        _EPROCESS *Process,
        _SECURITY_SUBJECT_CONTEXT *SubjectContext){
  void *v6; 
  _EX_FAST_REF *v7; 
  _QWORD *v8; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v10; 
  INT64 *v11; 
  SubjectContext->ProcessAuditId = (void *)*((_QWORD *)Process + 136);
  if( Thread )
  {
    if( (*((_DWORD *)Thread + 324) & 8) != 0 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockSharedEx((UINT64)Thread + 1280, 0i64);
      if( (*((_DWORD *)Thread + 324) & 8) != 0 )
      {
        v6 = (void *)(*((_QWORD *)Thread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
        ObfReferenceObject(v6);
        SubjectContext->ImpersonationLevel = *((_DWORD *)Thread + 298) & 3;
      }
      else
      {
        v6 = 0i64;
      }
      if( _InterlockedCompareExchange64((volatile signed __int64 *)Thread + 160, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((INT64 *)Thread + 160);
      KeAbPostRelease((char *)Thread + 1280);
      KeLeaveCriticalRegionThread((__int64)CurrentThread);
    }
    else
    {
      v6 = 0i64;
    }
  }
  else
  {
    v6 = 0i64;
  }
  SubjectContext->ClientToken = v6;
  v7 = (_EX_FAST_REF *)((char *)Process + 1208);
  v8 = ObFastReferenceObject((INT64 *)Process + 151);
  if( !v8 )
  {
    v10 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v10 + 242);
    v11 = (INT64 *)((char *)Process + 1080);
    ExAcquirePushLockSharedEx((UINT64)v11, 0i64);
    v8 = (_QWORD *)ObFastReferenceObjectLocked(v7);
    if( _InterlockedCompareExchange64(v11, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v11);
    KeAbPostRelease(v11);
    KeLeaveCriticalRegionThread((__int64)v10);
  }
  SubjectContext->PrimaryToken = v8;
  if( SeTokenLeakTracking )
  {
    if( v8 )
    {
      _InterlockedIncrement((volatile signed __int32 *)(v8[143] + 284i64));
      if( SubjectContext->PrimaryToken == (void *)SepTokenLeakToken )
        __debugbreak();
    }
    if( SubjectContext->ClientToken )
    {
      _InterlockedIncrement((volatile signed __int32 *)(*((_QWORD *)SubjectContext->ClientToken + 143) + 284i64));
      if( SubjectContext->ClientToken == (void *)SepTokenLeakToken )
        __debugbreak();
    }
  }
}

Referenced by: