RtlReleasePrivilege

VOID __stdcall RtlReleasePrivilege(PVOID StatePointer){
  int v2; 
  void *v3; 
  char *v4; 
  v2 = *((_DWORD *)StatePointer + 8);
  if( (v2 & 3) != 1 )
  {
    ZwAdjustPrivilegesToken(*(VOID **)StatePointer, 0, *((_TOKEN_PRIVILEGES **)StatePointer + 2), 0i64, 0i64, 0i64);
    v2 = *((_DWORD *)StatePointer + 8);
  }
  if( (v2 & 1) != 0 )
  {
    ZwSetInformationThread((PVOID)0xFFFFFFFFFFFFFFFEi64, ThreadImpersonationToken, (char *)StatePointer + 8, 8ui64);
    v3 = (void *)*((_QWORD *)StatePointer + 1);
    if( v3 )
      ZwClose(v3);
  }
  v4 = (char *)*((_QWORD *)StatePointer + 2);
  if( v4 != (char *)StatePointer + 36 )
    ExFreePoolWithTag(v4, 0);
  ZwClose(*(HANDLE *)StatePointer);
  ExFreePoolWithTag(StatePointer, 0);
}

Referenced by: