NtOpenThreadTokenEx

NTSTATUS __stdcall NtOpenThreadTokenEx(
        PVOID ThreadHandle,
        UINT64 DesiredAccess,
        UINT8 OpenAsSelf,
        UINT64 HandleAttributes,
        PVOID *TokenHandle){
  KPROCESSOR_MODE v5; 
  int v6; 
  ULONG v7; 
  PVOID *v8; 
  __int64 v9; 
  KPROCESSOR_MODE v10; 
  NTSTATUS result; 
  _DWORD *v12; 
  _ETHREAD *CurrentThread; 
  INT64 *v14; 
  _DWORD *v15; 
  struct _DMA_ADAPTER *v16; 
  int v17; 
  _SECURITY_IMPERSONATION_LEVEL v18; 
  char v19; 
  NTSTATUS inserted; 
  PVOID v21; 
  NTSTATUS ImpersonationTokenDacl; 
  __int64 v23; 
  struct DMA_ADAPTER *v24; 
  __int64 v25; 
  PVOID *Object; 
  bool v27; 
  char v28; 
  bool v29; 
  BOOLEAN v30; 
  KPROCESSOR_MODE v31; 
  PVOID v32; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; 
  PVOID DuplicateToken; 
  ULONG HandleAttributesa; 
  PVOID P; 
  VOID *TrustLevelSid; 
  PVOID Handle; 
  struct _SE_IMPERSONATION_STATE ImpersonationState; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int16 v41[16]; 
  PVOID v42; 
  ACCESS_MASK DesiredAccessa; 
  DesiredAccessa = DesiredAccess;
  DuplicateToken = 0i64;
  v28 = 0;
  v29 = 0;
  ImpersonationLevel = SecurityAnonymous;
  ImpersonationState = 0i64;
  v30 = 0;
  Handle = 0i64;
  memset(v41, 0, sizeof(v41));
  v42 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  P = 0i64;
  TrustLevelSid = 0i64;
  v27 = 0;
  v5 = *((_BYTE *)KeGetCurrentThread() + 562);
  v31 = v5;
  v6 = 73714;
  if( v5 )
    v6 = 7666;
  v7 = HandleAttributes & v6;
  HandleAttributesa = v7;
  if( v5 )
  {
    v8 = TokenHandle;
    v9 = (__int64)TokenHandle;
    if( (unsigned __int64)TokenHandle >= 0x7FFFFFFF0000i64 )
      v9 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v9 = *(_QWORD *)v9;
  }
  else
  {
    v8 = TokenHandle;
  }
  v10 = *((_BYTE *)KeGetCurrentThread() + 562);
  v32 = 0i64;
  result = ObReferenceObjectByHandle(ThreadHandle, 0x800u, (POBJECT_TYPE)PsThreadType, v10, &v32, 0i64);
  if( result >= 0 )
  {
    v12 = v32;
    if( (*((_DWORD *)v32 + 324) & 8) == 0 )
      goto LABEL_9;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    v14 = (INT64 *)((char *)v32 + 1280);
    ExAcquirePushLockSharedEx((UINT64)v32 + 1280, 0i64);
    if( (v12[324] & 8) != 0 )
    {
      v15 = v32;
      v16 = (struct _DMA_ADAPTER *)(*((_QWORD *)v32 + 149) & 0xFFFFFFFFFFFFFFF8ui64);
      v17 = v12[324];
      ObfReferenceObject(v16);
      ImpersonationLevel = v15[298] & 3;
      v29 = (v15[298] & 4) != 0;
      v28 = BYTE1(v17) & 1;
      v7 = HandleAttributesa;
    }
    else
    {
      v16 = 0i64;
    }
    if( _InterlockedCompareExchange64(v14, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v14);
    KeAbPostRelease(v14);
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
    if( !v16 )
    {
LABEL_9:
      HalPutDmaAdapter((PADAPTER_OBJECT)v32);
      return -1073741700;
    }
    v18 = ImpersonationLevel;
    if( ImpersonationLevel == SecurityAnonymous )
    {
      HalPutDmaAdapter(v16);
      HalPutDmaAdapter((PADAPTER_OBJECT)v32);
      return -1073741658;
    }
    if( OpenAsSelf )
    {
      v30 = PsDisableImpersonation(KeGetCurrentThread(), &ImpersonationState);
      v18 = ImpersonationLevel;
    }
    v19 = v28;
    if( v28 )
    {
      if( OpenAsSelf )
      {
        if( ImpersonationState.Token )
        {
          TrustLevelSid = (VOID *)*((_QWORD *)ImpersonationState.Token + 138);
          v27 = 1;
        }
      }
      else
      {
        v25 = *((_QWORD *)v32 + 183);
        if( v25 )
          TrustLevelSid = *(VOID **)(v25 + 1104);
        v27 = v25 != 0;
      }
      v23 = *((_QWORD *)v32 + 68);
      v24 = (struct DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)v23);
      ImpersonationTokenDacl = SepCreateImpersonationTokenDacl((_TOKEN *)v16, v24, (_ACL **)&P);
      ObFastDereferenceObject((INT64 *)(v23 + 1208), v24);
      v21 = P;
      if( ImpersonationTokenDacl < 0 )
        goto LABEL_22;
      if( P )
      {
        LOBYTE(v41[0]) = 1;
        if( v41[1] >= 0 )
        {
          v42 = P;
          v41[1] = v41[1] & 0xFFF3 | 4;
        }
      }
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = HandleAttributesa;
      ObjectAttributes.ObjectName = 0i64;
      ObjectAttributes.SecurityDescriptor = P ? v41 : 0i64;
      ObjectAttributes.SecurityQualityOfService = 0i64;
      ImpersonationTokenDacl = SepDuplicateToken(
                                 (_TOKEN *)v16,
                                 &ObjectAttributes,
                                 v29,
                                 TokenImpersonation,
                                 v18,
                                 0,
                                 0,
                                 (_TOKEN **)&DuplicateToken);
      if( ImpersonationTokenDacl < 0 )
        goto LABEL_22;
      if( v27 )
        ImpersonationTokenDacl = SepSetTokenTrust((_TOKEN *)DuplicateToken, TrustLevelSid);
      if( ImpersonationTokenDacl < 0 )
        goto LABEL_22;
      ObfReferenceObject(DuplicateToken);
      LODWORD(Object) = 0;
      inserted = ObInsertObjectEx(DuplicateToken, 0i64, DesiredAccessa, 0i64, (UINT64)Object, 0i64, &Handle);
    }
    else
    {
      inserted = ObOpenObjectByPointer(v16, v7, 0i64, DesiredAccessa, (POBJECT_TYPE)SeTokenObjectType, v31, &Handle);
      v21 = P;
    }
    ImpersonationTokenDacl = inserted;
LABEL_22:
    if( v21 )
      ExFreePoolWithTag(v21, 0);
    if( v30 )
    {
      PsRestoreImpersonation(KeGetCurrentThread(), &ImpersonationState);
      v19 = v28;
    }
    if( ImpersonationTokenDacl >= 0 && v19 )
      PsSwapImpersonationToken((__int64)v32, v16, (struct _DMA_ADAPTER *)DuplicateToken);
    HalPutDmaAdapter(v16);
    if( DuplicateToken )
      HalPutDmaAdapter((PADAPTER_OBJECT)DuplicateToken);
    HalPutDmaAdapter((PADAPTER_OBJECT)v32);
    if( ImpersonationTokenDacl >= 0 )
      *v8 = Handle;
    return ImpersonationTokenDacl;
  }
  return result;
}

Referenced by: