NtOpenProcessTokenEx

INT64 __fastcall NtOpenProcessTokenEx(
        VOID *ProcessHandle,
        UINT64 DesiredAccess,
        UINT64 HandleAttributes,
        VOID **TokenHandle){
  ACCESS_MASK v5; 
  KPROCESSOR_MODE AccessMode; 
  int v7; 
  ULONG v8; 
  __int64 v9; 
  INT64 result; 
  PVOID v11; 
  _EX_FAST_REF *v12; 
  struct _DMA_ADAPTER *v13; 
  NTSTATUS v14; 
  INT64 *v15; 
  PVOID Object; 
  void *Handle; 
  _ETHREAD *CurrentThread; 
  v5 = DesiredAccess;
  Handle = 0i64;
  AccessMode = *((_BYTE *)KeGetCurrentThread() + 562);
  v7 = 73714;
  if( AccessMode )
    v7 = 7666;
  v8 = HandleAttributes & v7;
  if( AccessMode )
  {
    v9 = (__int64)TokenHandle;
    if( (unsigned __int64)TokenHandle >= 0x7FFFFFFF0000i64 )
      v9 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v9 = *(_QWORD *)v9;
  }
  Object = 0i64;
  result = ObpReferenceObjectByHandleWithTag(
             (ULONG_PTR)ProcessHandle,
             4096,
             (__int64)PsProcessType,
             *((_BYTE *)KeGetCurrentThread() + 562),
             0x65537350u,
             (__int64)&Object,
             0i64,
             0i64);
  if( (int)result >= 0 )
  {
    v11 = Object;
    v12 = (_EX_FAST_REF *)((char *)Object + 1208);
    v13 = (struct _DMA_ADAPTER *)ObFastReferenceObject((INT64 *)Object + 151);
    if( !v13 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      v15 = (INT64 *)((char *)Object + 1080);
      ExAcquirePushLockSharedEx((UINT64)Object + 1080, 0i64);
      v13 = (struct _DMA_ADAPTER *)ObFastReferenceObjectLocked(v12);
      if( _InterlockedCompareExchange64(v15, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v15);
      KeAbPostRelease(v15);
      KeLeaveCriticalRegionThread((__int64)CurrentThread);
      v11 = Object;
    }
    ObfDereferenceObjectWithTag(v11, 0x65537350ui64);
    v14 = ObOpenObjectByPointer(v13, v8, 0i64, v5, (POBJECT_TYPE)SeTokenObjectType, AccessMode, &Handle);
    HalPutDmaAdapter(v13);
    if( v14 >= 0 )
      *TokenHandle = Handle;
    return(unsigned int)v14;
  }
  return result;
}

Referenced by: