IoReferenceIoAttributionFromThread

NTSTATUS __stdcall IoReferenceIoAttributionFromThread(_ETHREAD *Thread, PVOID *OpaqueContext){
  __int64 WorkOnBehalfThread; 
  void *v5; 
  __int64 v6; 
  NTSTATUS v7; 
  int v9; 
  v9 = 0;
  WorkOnBehalfThread = PsGetWorkOnBehalfThread((__int64)Thread, &v9);
  v5 = (void *)WorkOnBehalfThread;
  if( WorkOnBehalfThread )
    v6 = *(_QWORD *)(WorkOnBehalfThread + 544);
  else
    v6 = *((_QWORD *)Thread + 68);
  v7 = IopReferenceIoAttributionFromProcess(v6, 0, OpaqueContext);
  if( v9 )
    ObDereferenceObjectDeferDelete(v5);
  return v7;
}

Referenced by: