PspReferenceTokenForNewProcess

NTSTATUS __fastcall PspReferenceTokenForNewProcess(_EPROCESS *a1, void *a2, KPROCESSOR_MODE a3, _QWORD *a4){
  PACCESS_TOKEN v5; 
  NTSTATUS result; 
  PVOID Object; 
  if( !a2 )
  {
    if( a1 )
    {
      v5 = PsReferencePrimaryToken((PEPROCESS)a1);
    }
    else
    {
      v5 = PspBootAccessToken;
      ObfReferenceObject(PspBootAccessToken);
    }
    goto LABEL_4;
  }
  Object = 0i64;
  result = ObReferenceObjectByHandle(a2, 1u, (POBJECT_TYPE)SeTokenObjectType, a3, &Object, 0i64);
  v5 = Object;
  if( result >= 0 )
  {
LABEL_4:
    *a4 = v5;
    return 0;
  }
  return result;
}

Referenced by: