PsReferenceEffectiveToken

VOID *__fastcall PsReferenceEffectiveToken(
        _ETHREAD *Thread,
        _TOKEN_TYPE *TokenType,
        UINT8 *EffectiveOnly,
        _SECURITY_IMPERSONATION_LEVEL *ImpersonationLevel,
        _PS_PROTECTION *ProcessProtection){
  _ETHREAD *CurrentThread; 
  __int64 v10; 
  void *v11; 
  VOID *v12; 
  INT64 *Lock; 
  _ETHREAD *v15; 
  __int64 v16; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( Thread == CurrentThread )
    v10 = *((_QWORD *)CurrentThread + 23);
  else
    v10 = *((_QWORD *)Thread + 68);
  v11 = 0i64;
  if( (*((_DWORD *)Thread + 324) & 8) == 0 )
    goto LABEL_4;
  v16 = *((_QWORD *)Thread + 68);
  v15 = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)v15 + 242);
  Lock = (INT64 *)((char *)Thread + 1280);
  ExAcquirePushLockSharedEx((UINT64)Thread + 1280, 0i64);
  if( (*((_DWORD *)Thread + 324) & 8) != 0 )
  {
    v11 = (void *)(*((_QWORD *)Thread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
    ObfReferenceObject(v11);
    *ImpersonationLevel = *((_DWORD *)Thread + 298) & 3;
    *EffectiveOnly = (*((_BYTE *)Thread + 1192) & 4) != 0;
    if( ProcessProtection )
      ProcessProtection->Level = *(unsigned __int8 *)(v16 + 2170);
  }
  if( _InterlockedCompareExchange64(Lock, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(Lock);
  KeAbPostRelease(Lock);
  KeLeaveCriticalRegionThread((__int64)v15);
  if( v11 )
  {
    *TokenType = TokenImpersonation;
    return v11;
  }
  else
  {
LABEL_4:
    v12 = ObFastReferenceObject((INT64 *)(v10 + 1208));
    if( !v12 )
    {
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockSharedEx(v10 + 1080, 0i64);
      v12 = (VOID *)ObFastReferenceObjectLocked((_EX_FAST_REF *)(v10 + 1208));
      if( _InterlockedCompareExchange64((volatile signed __int64 *)(v10 + 1080), 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((INT64 *)(v10 + 1080));
      KeAbPostRelease((PVOID)(v10 + 1080));
      KeLeaveCriticalRegionThread((__int64)CurrentThread);
    }
    *TokenType = TokenPrimary;
    *EffectiveOnly = 0;
    if( ProcessProtection )
      ProcessProtection->Level = *(unsigned __int8 *)(v10 + 2170);
    return v12;
  }
}

Referenced by: