SepDeleteSessionLowboxEntries
VOID __stdcall SepDeleteSessionLowboxEntries(){
_ETHREAD *CurrentThread;
unsigned int v1;
_EX_PUSH_LOCK *i;
_ETHREAD *v3;
unsigned __int64 v4;
_EX_PUSH_LOCK *bf_0;
int v6;
__int64 v7;
int v8;
unsigned int v9;
_QWORD *v10;
unsigned int v11;
_QWORD *v12;
__int64 j;
unsigned __int64 v14;
int v15;
_ETHREAD *v16;
unsigned int v17;
unsigned __int8 v18;
int v19;
bool v20;
__int64 v21;
_KLOCK_ENTRY *v22;
__int64 v23;
__int64 v24;
_EX_PUSH_LOCK **v25;
_ETHREAD *v26;
unsigned int SessionId;
unsigned __int8 v28;
int v29;
__int64 v30;
_KLOCK_ENTRY *v31;
__int64 v32;
_ETHREAD *v33;
unsigned __int8 v34;
int v35;
__int64 v36;
_KLOCK_ENTRY *v37;
__int64 v38;
UINT64 v39;
UINT64 a3;
UINT64 v41;
int v42;
int v43;
if( qword_140C25D48 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&stru_140C25D50, 0i64);
v1 = -1;
for( i = (_EX_PUSH_LOCK *)*qword_140C25D48; i != (_EX_PUSH_LOCK *)qword_140C25D48; i = bf_0 )
{
v3 = (_ETHREAD *)KeGetCurrentThread();
v4 = (unsigned __int64)&i[3];
bf_0 = (_EX_PUSH_LOCK *)i->_bf_0;
--v3->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(i + 3, 0i64);
v6 = i[4]._bf_0;
v7 = i[5]._bf_0;
HIDWORD(v39) = 0;
v8 = (v7 & 4) != 0 ? 0x20 : 0;
v9 = v8 + v6 - 1;
v10 = (_QWORD *)(v7 - ((v7 & 4) != 0 ? 4 : 0));
if( v6 )
{
v12 = v10;
for( j = ~*v10 | ((1i64 << v8) - 1); j == -1; j = ~*v12 )
{
if( ++v12 > &v10[(unsigned __int64)v9 >> 6] )
{
v11 = -1;
goto LABEL_14;
}
}
_BitScanForward64(&v14, ~j);
v11 = v14 + ((unsigned int)(v12 - v10) << 6);
HIDWORD(v39) = v14;
if( v11 > v9 )
v11 = -1;
}
else
{
v11 = -1;
}
LABEL_14:
v15 = v11 - v8;
if( v11 == -1 )
v15 = -1;
if( v15 == -1 )
{
RtlDeleteHashTable((_RTL_DYNAMIC_HASH_TABLE *)i[6]._bf_0);
ExFreePoolWithTag(i[5].Ptr, 0);
v24 = i->_bf_0;
if( *(_EX_PUSH_LOCK **)(i->_bf_0 + 8) != i || (v25 = (_EX_PUSH_LOCK **)i[1]._bf_0, *v25 != i) )
__fastfail(3u);
*v25 = (_EX_PUSH_LOCK *)v24;
*(_QWORD *)(v24 + 8) = v25;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(i + 3);
LODWORD(v41) = 0;
v26 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&i[3]) == 1 )
SessionId = MmGetSessionIdEx(v26->Tcb.ApcState.Process);
else
SessionId = -1;
--v26->Tcb.SpecialApcDisable;
v28 = ++v26->Tcb.AbAllocationRegionCount;
v29 = ((char)v26->Tcb.AbEntrySummary | (char)v26->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v30, v29);
v43 = v30;
if( v20 )
break;
v31 = &v26->Tcb.LockEntries[v30];
v29 &= ~(1 << v30);
if( (v31->AcquiredByte & 1) != 0
&& (v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
&& v31->LockState.SessionId == SessionId )
{
v31->AcquiredByte &= ~1u;
if( v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v31 )
{
v31->CrossThreadReleasableAndBusyByte |= 2u;
if( v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v31);
LODWORD(v41) = 0;
LODWORD(v41) = v31->BoostBitmap.AllFields & 0x1FFFF;
v31->BoostBitmap.AllFields &= 0xFFFE0000;
v31->ThreadLocalFlags &= ~1u;
v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v32 = v31 - v26->Tcb.LockEntries;
if( v28 == 1 )
v26->Tcb.AbEntrySummary |= 1 << v32;
else
_InterlockedOr8((volatile signed __int8 *)&v26->Tcb.AbOrphanedEntrySummary, 1 << v32);
goto LABEL_61;
}
break;
}
}
}
if( (*(&v26->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v26, &i[3], (PVOID)SessionId, 0i64);
LABEL_61:
--v26->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v26->Tcb, &i[3], &v41);
v20 = v26->Tcb.SpecialApcDisable++ == -1;
if( v20 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v26->Tcb.ApcState.ApcListHead[0].Flink != &v26->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
ExFreePoolWithTag(i, 0);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(i + 3);
LODWORD(a3) = 0;
v16 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&i[3]) == 1 )
v17 = MmGetSessionIdEx(v16->Tcb.ApcState.Process);
else
v17 = -1;
--v16->Tcb.SpecialApcDisable;
v18 = ++v16->Tcb.AbAllocationRegionCount;
v19 = ((char)v16->Tcb.AbEntrySummary | (char)v16->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v21, v19);
v42 = v21;
if( v20 )
break;
v22 = &v16->Tcb.LockEntries[v21];
v19 &= ~(1 << v21);
if( (v22->AcquiredByte & 1) != 0
&& (v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
&& v22->LockState.SessionId == v17 )
{
v22->AcquiredByte &= ~1u;
if( v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v22 )
{
v22->CrossThreadReleasableAndBusyByte |= 2u;
if( v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v22);
LODWORD(a3) = 0;
LODWORD(a3) = v22->BoostBitmap.AllFields & 0x1FFFF;
v22->BoostBitmap.AllFields &= 0xFFFE0000;
v22->ThreadLocalFlags &= ~1u;
v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v23 = v22 - v16->Tcb.LockEntries;
if( v18 == 1 )
v16->Tcb.AbEntrySummary |= 1 << v23;
else
_InterlockedOr8((volatile signed __int8 *)&v16->Tcb.AbOrphanedEntrySummary, 1 << v23);
goto LABEL_34;
}
break;
}
}
}
if( (*(&v16->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v16, (PVOID)v4, (PVOID)v17, 0i64);
LABEL_34:
--v16->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v16->Tcb, (VOID *)v4, &a3);
v20 = v16->Tcb.SpecialApcDisable++ == -1;
if( v20 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v16->Tcb.ApcState.ApcListHead[0].Flink != &v16->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
}
}
if( (_InterlockedExchangeAdd64(&stru_140C25D50._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&stru_140C25D50);
LODWORD(v39) = 0;
v33 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&stru_140C25D50) == 1 )
v1 = MmGetSessionIdEx(v33->Tcb.ApcState.Process);
--v33->Tcb.SpecialApcDisable;
v34 = ++v33->Tcb.AbAllocationRegionCount;
v35 = ((char)v33->Tcb.AbEntrySummary | (char)v33->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v36, v35);
if( v20 )
break;
v37 = &v33->Tcb.LockEntries[v36];
v35 &= ~(1 << v36);
if( (v37->AcquiredByte & 1) != 0
&& (v37->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v37->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&stru_140C25D50 & 0x7FFFFFFFFFFFFFFCi64)
&& v37->LockState.SessionId == v1 )
{
v37->AcquiredByte &= ~1u;
if( v37->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v37 )
{
v37->CrossThreadReleasableAndBusyByte |= 2u;
if( v37->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v37);
LODWORD(v39) = v37->BoostBitmap.AllFields & 0x1FFFF;
v37->BoostBitmap.AllFields &= 0xFFFE0000;
v37->ThreadLocalFlags &= ~1u;
v37->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v38 = v37 - v33->Tcb.LockEntries;
if( v34 == 1 )
v33->Tcb.AbEntrySummary |= 1 << v38;
else
_InterlockedOr8((volatile signed __int8 *)&v33->Tcb.AbOrphanedEntrySummary, 1 << v38);
goto LABEL_87;
}
break;
}
}
}
if( (*(&v33->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v33, &stru_140C25D50, (PVOID)v1, 0i64);
LABEL_87:
--v33->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v33->Tcb, &stru_140C25D50, &v39);
v20 = v33->Tcb.SpecialApcDisable++ == -1;
if( v20 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v33->Tcb.ApcState.ApcListHead[0].Flink != &v33->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
}
}Referenced by:
SepDeReferenceLogonSession
SepDeleteLogonSessionTrack