EtwpGetSidExtendedHeaderItem

INT64 __fastcall EtwpGetSidExtendedHeaderItem(INT64 a1){
  _ETHREAD *CurrentThread; 
  struct _DMA_ADAPTER *v3; 
  _TOKEN_TYPE v4; 
  struct _DMA_ADAPTER *v5; 
  int v6; 
  UINT64 v7; 
  unsigned int v8; 
  UINT8 EffectiveOnly[4]; 
  _TOKEN_TYPE TokenType; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; 
  int Size[21]; 
  EffectiveOnly[0] = 0;
  ImpersonationLevel = SecurityAnonymous;
  Size[0] = 0;
  TokenType = 0;
  memset((INT64)&Size[1], 0i64);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = (struct _DMA_ADAPTER *)PsReferenceEffectiveToken(
                                CurrentThread,
                                &TokenType,
                                EffectiveOnly,
                                &ImpersonationLevel,
                                0i64);
  v4 = TokenType;
  v5 = v3;
  if( TokenType == TokenImpersonation && ImpersonationLevel < SecurityImpersonation )
  {
    if( v3 )
      HalPutDmaAdapter(v3);
    v5 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken(*((PEPROCESS *)CurrentThread + 68));
    v4 = TokenPrimary;
  }
  SeQueryUserSidToken(v5, &Size[1], 0x44ui64, (UINT64 *)Size);
  if( v4 == TokenPrimary )
  {
    ObFastDereferenceObject((INT64 *)(*((_QWORD *)CurrentThread + 68) + 1208i64), v5);
  }
  else if( v5 )
  {
    HalPutDmaAdapter(v5);
  }
  v6 = Size[0];
  v7 = (unsigned int)Size[0];
  *(_DWORD *)(a1 + 2) = 2;
  *(_WORD *)(a1 + 6) = v6;
  v8 = v6 + 8;
  *(_WORD *)a1 = (v6 + 15) & 0xFFF8;
  memmove((UINT8 *)(a1 + 8), (UINT8 *)&Size[1], v7);
  return memset(a1 + v8, 0i64);
}

Referenced by: