AlpcpImpersonateMessage

INT64 __fastcall AlpcpImpersonateMessage(_ALPC_PORT *PortObject, _KALPC_MESSAGE *Message, UINT64 AllowAnonymous){
  int v3; 
  int v6; 
  int v7; 
  struct _DMA_ADAPTER *v8; 
  struct _SECURITY_CLIENT_CONTEXT *p_ClientContext; 
  _ALPC_PORT *v10; 
  __int64 v11; 
  _ALPC_PORT *v12; 
  _ETHREAD *v13; 
  _SECURITY_QUALITY_OF_SERVICE *v14; 
  int v15; 
  unsigned int v16; 
  UINT8 v17; 
  struct _DMA_ADAPTER *ClientToken; 
  int v20; 
  int v21; 
  __int128 ImpersonationLevel; 
  __int128 Token; 
  struct _SECURITY_CLIENT_CONTEXT ClientContext; 
  _SECURITY_IMPERSONATION_LEVEL v25; 
  v21 = AllowAnonymous;
  v6 = v3;
  memset((INT64)&ClientContext, 0i64);
  v7 = 0;
  v8 = 0i64;
  p_ClientContext = 0i64;
  if( (*((_BYTE *)Message + 40) & 7) != 3 )
    return(unsigned int)-1073741790;
  if( (*((_WORD *)Message + 122) & 0x4000) != 0 )
    return(unsigned int)-1073741790;
  v10 = (_ALPC_PORT *)*((_QWORD *)Message + 2);
  if( v10 != PortObject && ((*((_BYTE *)PortObject + 416) & 6) != 6 || v10 != **((_ALPC_PORT ***)PortObject + 2)) )
    return(unsigned int)-1073741790;
  v11 = *((_QWORD *)Message + 17);
  if( !v11 )
  {
    v12 = AlpcpReferenceConnectedPort(PortObject);
    v8 = (struct _DMA_ADAPTER *)v12;
    if( v12 )
    {
      if( (*((_DWORD *)v12 + 64) & 0x10000) != 0 )
      {
        if( (*((_DWORD *)v12 + 104) & 0x400) == 0 )
        {
          p_ClientContext = (struct _SECURITY_CLIENT_CONTEXT *)((char *)v12 + 64);
          goto LABEL_16;
        }
        v13 = (_ETHREAD *)*((_QWORD *)Message + 4);
        if( v13 )
        {
          if( v6 && *((_DWORD *)v12 + 66) < v25 )
          {
            v16 = -1073741790;
            goto LABEL_20;
          }
          v14 = (_SECURITY_QUALITY_OF_SERVICE *)((char *)v12 + 260);
          if( v21 )
            v15 = SeCreateClientSecurityEx(v13, v14, 0, &ClientContext);
          else
            v15 = SeCreateClientSecurity((PETHREAD)v13, v14, 0, &ClientContext);
          v16 = v15;
          if( v15 < 0 )
            goto LABEL_20;
          p_ClientContext = &ClientContext;
          v7 = 1;
LABEL_16:
          ImpersonationLevel = *(_OWORD *)&p_ClientContext->SecurityQos.Length;
          Token = *(_OWORD *)&p_ClientContext->ClientToken;
          if( v6 )
          {
            if( v25 > p_ClientContext->SecurityQos.ImpersonationLevel )
            {
              v16 = -1073741790;
              goto LABEL_20;
            }
            DWORD1(ImpersonationLevel) = v25;
          }
          if( BYTE8(Token) )
            v17 = BYTE1(*(_QWORD *)&p_ClientContext->DirectlyAccessClientToken);
          else
            v17 = BYTE1(*(_QWORD *)&p_ClientContext->SecurityQos.ContextTrackingMode);
          v16 = PsImpersonateClient(
                  (_ETHREAD *)KeGetCurrentThread(),
                  (PVOID)Token,
                  1u,
                  v17,
                  SDWORD1(ImpersonationLevel));
          goto LABEL_20;
        }
        v16 = -1073741790;
      }
      else
      {
        v16 = -1073741790;
      }
LABEL_20:
      if( v8 )
        HalPutDmaAdapter(v8);
      if( v7 )
      {
        ClientToken = (struct _DMA_ADAPTER *)p_ClientContext->ClientToken;
        if( *(_DWORD *)&ClientToken[12].Version == 1 || ClientToken )
          HalPutDmaAdapter(ClientToken);
      }
      return v16;
    }
    return(unsigned int)-1073741790;
  }
  ExAcquirePushLockExclusiveEx(v11 - 16, 0i64);
  v20 = *(_DWORD *)(v11 + 104);
  if( (v20 & 1) == 0 )
  {
    *(_DWORD *)(v11 + 104) = v20 | 2;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v11 - 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)(v11 - 16));
    KeAbPostRelease((PVOID)(v11 - 16));
    p_ClientContext = (struct _SECURITY_CLIENT_CONTEXT *)(v11 + 32);
    goto LABEL_16;
  }
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v11 - 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)(v11 - 16));
  KeAbPostRelease((PVOID)(v11 - 16));
  return 3221225506i64;
}

Referenced by: