NtImpersonateThread

NTSTATUS __stdcall NtImpersonateThread(
        PVOID ServerThreadHandle,
        PVOID ClientThreadHandle,
        SECURITY_QUALITY_OF_SERVICE *SecurityQos){
  KPROCESSOR_MODE v6; 
  NTSTATUS result; 
  int v8; 
  struct _DMA_ADAPTER *v9; 
  PVOID Object; 
  struct _SECURITY_QUALITY_OF_SERVICE ClientSecurityQos; 
  struct _SECURITY_CLIENT_CONTEXT ClientContext; 
  PVOID v13; 
  *(_QWORD *)&ClientSecurityQos.Length = 0i64;
  *(_DWORD *)&ClientSecurityQos.ContextTrackingMode = 0;
  memset((INT64)&ClientContext, 0i64);
  v6 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v6 && ((unsigned __int8)SecurityQos & 3) != 0 )
    ExRaiseDatatypeMisalignment();
  ClientSecurityQos = *SecurityQos;
  Object = 0i64;
  result = ObReferenceObjectByHandle(ClientThreadHandle, 0x200u, (POBJECT_TYPE)PsThreadType, v6, &Object, 0i64);
  if( result >= 0 )
  {
    v13 = 0i64;
    v8 = ObReferenceObjectByHandle(ServerThreadHandle, 0x100u, (POBJECT_TYPE)PsThreadType, v6, &v13, 0i64);
    v9 = (struct _DMA_ADAPTER *)Object;
    if( v8 >= 0 )
    {
      v8 = SeCreateClientSecurity((PETHREAD)Object, &ClientSecurityQos, 0, &ClientContext);
      if( v8 >= 0 )
      {
        v8 = SeImpersonateClientEx(&ClientContext, (PETHREAD)v13);
        HalPutDmaAdapter((PADAPTER_OBJECT)ClientContext.ClientToken);
      }
      HalPutDmaAdapter((PADAPTER_OBJECT)v13);
    }
    HalPutDmaAdapter(v9);
    return v8;
  }
  return result;
}

Referenced by: