PsSwapImpersonationToken

NTSTATUS __stdcall PsSwapImpersonationToken(_ETHREAD *Thread, VOID *OldToken, VOID *NewToken){
  NTSTATUS v3; 
  _ADAPTER_OBJECT *AdjustedClientToken; 
  _ETHREAD *CurrentThread; 
  _PS_CLIENT_SECURITY_CONTEXT v9; 
  char v10; 
  _ADAPTER_OBJECT *v12; 

  v3 = 0;
  AdjustedClientToken = 0i64;
  if( (Thread->CrossThreadFlags & 8) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    ObfReferenceObject(NewToken);
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&Thread->ThreadLock, 0i64);
    if( (Thread->CrossThreadFlags & 8) != 0 )
    {
      v9.ImpersonationData = (unsigned __int64)Thread->ClientSecurity;
      if( (VOID *)(v9.ImpersonationData & 0xFFFFFFFFFFFFFFF8ui64) == OldToken
        && (Thread->CrossThreadFlags & 0x100) != 0 )
      {
        AdjustedClientToken = (_ADAPTER_OBJECT *)Thread->AdjustedClientToken;
        Thread->AdjustedClientToken = 0i64;
        Thread->ClientSecurity.ImpersonationData = (unsigned __int64)NewToken | v9._bf_0 & 7;
        _InterlockedAnd((volatile signed __int32 *)&Thread->1296, 0xFFFFFEFF);
      }
      else
      {
        v3 = -1073741823;
      }
    }
    else
    {
      v3 = -1073741700;
    }
    v10 = _InterlockedExchangeAdd64(&Thread->ThreadLock._bf_0, 0xFFFFFFFFFFFFFFFFui64);
    if( (v10 & 2) != 0 && (v10 & 4) == 0 )
      ExfTryToWakePushLock(&Thread->ThreadLock);
    KeAbPostRelease(&Thread->ThreadLock);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    if( v3 < 0 )
    {
      v12 = (_ADAPTER_OBJECT *)NewToken;
    }
    else
    {
      HalPutDmaAdapter((PADAPTER_OBJECT)OldToken);
      if( !AdjustedClientToken )
        return v3;
      v12 = AdjustedClientToken;
    }
    HalPutDmaAdapter(v12);
    return v3;
  }
  return -1073741700;
}

Referenced by: