PsDisableImpersonation

BOOLEAN __stdcall PsDisableImpersonation(_ETHREAD *Thread, PSE_IMPERSONATION_STATE ImpersonationState){
  char v2; 
  _ETHREAD *CurrentThread; 
  void *v6; 
  char v7; 
  BOOLEAN result; 
  struct _DMA_ADAPTER *v9; 
  v2 = 0;
  if( (*((_DWORD *)Thread + 324) & 8) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx((UINT64)Thread + 1280, 0i64);
    if( _interlockedbittestandreset((volatile signed __int32 *)Thread + 324, 3u) )
    {
      v2 = 1;
      ImpersonationState->Level = *((_DWORD *)Thread + 298) & 3;
      ImpersonationState->EffectiveOnly = (*((_BYTE *)Thread + 1192) & 4) != 0;
      ImpersonationState->CopyOnOpen = BYTE1(*((_DWORD *)Thread + 324)) & 1;
      v6 = (void *)*((_QWORD *)Thread + 183);
      if( v6 )
      {
        ImpersonationState->Token = v6;
        v9 = (struct _DMA_ADAPTER *)(*((_QWORD *)Thread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
        *((_QWORD *)Thread + 183) = 0i64;
        HalPutDmaAdapter(v9);
      }
      else
      {
        ImpersonationState->Token = (PACCESS_TOKEN)(*((_QWORD *)Thread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
      }
    }
    v7 = _InterlockedExchangeAdd64((volatile signed __int64 *)Thread + 160, 0xFFFFFFFFFFFFFFFFui64);
    if( (v7 & 2) != 0 && (v7 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)Thread + 160);
    KeAbPostRelease((char *)Thread + 1280);
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
    if( v2 )
      return 1;
  }
  ImpersonationState->Level = SecurityAnonymous;
  result = 0;
  *(_WORD *)&ImpersonationState->CopyOnOpen = 0;
  ImpersonationState->Token = 0i64;
  return result;
}

Referenced by: