PsReferenceImpersonationTokenEx

VOID *__stdcall PsReferenceImpersonationTokenEx(
        _ETHREAD *Thread,
        UINT64 Flags,
        UINT8 *CopyOnOpen,
        UINT8 *EffectiveOnly,
        _SECURITY_IMPERSONATION_LEVEL *ImpersonationLevel,
        PS_PROTECTION *ProcessProtection){
  char v8; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  void *AdjustedClientToken; 
  UINT8 v14; 

  v8 = Flags;
  if( (Thread->CrossThreadFlags & 8) == 0 )
    return 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = Thread->Tcb.Process;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockSharedEx(&Thread->ThreadLock, 0i64);
  if( (Thread->CrossThreadFlags & 8) != 0 )
  {
    if( (v8 & 1) != 0 && (AdjustedClientToken = Thread->AdjustedClientToken) != 0i64 )
    {
      v14 = 0;
    }
    else
    {
      AdjustedClientToken = (void *)(Thread->ClientSecurity.ImpersonationData & 0xFFFFFFFFFFFFFFF8ui64);
      v14 = BYTE1(Thread->CrossThreadFlags) & 1;
    }
    *CopyOnOpen = v14;
    ObfReferenceObject(AdjustedClientToken);
    *ImpersonationLevel = Thread->ClientSecurity.ImpersonationData & 3;
    *EffectiveOnly = (Thread->ClientSecurity._bf_0 & 4) != 0;
    if( ProcessProtection )
      ProcessProtection->Level = (unsigned __int8)Process->Protection;
  }
  else
  {
    AdjustedClientToken = 0i64;
  }
  if( _InterlockedCompareExchange64(&Thread->ThreadLock._bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(&Thread->ThreadLock);
  KeAbPostRelease(&Thread->ThreadLock);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return AdjustedClientToken;
}

Referenced by: