PsReferenceImpersonationTokenEx

VOID *__fastcall PsReferenceImpersonationTokenEx(INT64 a1, CHAR a2, BYTE *a3, BOOL *a4, INT64 *a5, BYTE *a6){
  _ETHREAD *CurrentThread; 
  __int64 v12; 
  void *v13; 
  BYTE v14; 
  if( (*(_DWORD *)(a1 + 1296) & 8) == 0 )
    return 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v12 = *(_QWORD *)(a1 + 544);
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockSharedEx(a1 + 1280, 0i64);
  if( (*(_DWORD *)(a1 + 1296) & 8) != 0 )
  {
    if( (a2 & 1) != 0 && (v13 = *(void **)(a1 + 1464)) != 0i64 )
    {
      v14 = 0;
    }
    else
    {
      v13 = (void *)(*(_QWORD *)(a1 + 1192) & 0xFFFFFFFFFFFFFFF8ui64);
      v14 = BYTE1(*(_DWORD *)(a1 + 1296)) & 1;
    }
    *a3 = v14;
    ObfReferenceObject(v13);
    *(_DWORD *)a5 = *(_DWORD *)(a1 + 1192) & 3;
    *(_BYTE *)a4 = (*(_BYTE *)(a1 + 1192) & 4) != 0;
    if( a6 )
      *a6 = *(_BYTE *)(v12 + 2170);
  }
  else
  {
    v13 = 0i64;
  }
  if( _InterlockedCompareExchange64((volatile signed __int64 *)(a1 + 1280), 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)(a1 + 1280));
  KeAbPostRelease((PVOID)(a1 + 1280));
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v13;
}

Referenced by: