SepUpdateLogonSessionTrack

__int64 __fastcall SepUpdateLogonSessionTrack(__int64 a1, __int64 a2, INT64 a3){
  unsigned int v3; 
  _ETHREAD *CurrentThread; 
  unsigned int v6; 
  __int64 v7; 
  _ERESOURCE *v8; 
  __int64 *v9; 
  void *v10; 
  VOID **PoolWithTag; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 

  v3 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = (unsigned int)(1529154084 * *(_DWORD *)a1) >> 28;
  --CurrentThread->Tcb.KernelApcDisable;
  v7 = v6;
  v8 = &stru_140CEC5A0 + (v6 & 3);
  ExAcquireResourceExclusiveLite((UINT64)v8, 1, a3);
  v9 = *(__int64 **)(SepLogonSessions + 8 * v7);
  if( v9 )
  {
    while( *(_DWORD *)a1 != *((_DWORD *)v9 + 2) || *(_DWORD *)(a1 + 4) != *((_DWORD *)v9 + 3) )
    {
      v9 = (__int64 *)*v9;
      if( !v9 )
        goto LABEL_10;
    }
    v10 = (void *)v9[8];
    if( v10 )
    {
      ExFreePoolWithTag(v10, 0);
      v9[8] = 0i64;
      v9[10] = 0i64;
    }
    PoolWithTag = ExAllocatePoolWithTag(
                    1ui64,
                    *(unsigned __int16 *)(a1 + 24) + 2i64 + ((*(unsigned __int16 *)(a1 + 8) + 9i64) & 0xFFFFFFF8i64),
                    1934386515i64);
    if( PoolWithTag )
    {
      v9[8] = (__int64)PoolWithTag;
      v9[10] = (__int64)PoolWithTag + ((*(unsigned __int16 *)(a1 + 8) + 9i64) & 0xFFFFFFFFFFFFFFF8ui64);
      memmove(PoolWithTag, (const VOID *)(a1 + 40), *(unsigned __int16 *)(a1 + 8));
      v12 = *(unsigned __int16 *)(a1 + 8);
      *((_WORD *)v9 + 28) = v12;
      *((_WORD *)v9 + 29) = v12 + 2;
      *(_WORD *)(v9[8] + 2 * (v12 >> 1)) = 0;
      memmove(
        (VOID *)v9[10],
        (const VOID *)(((*(unsigned __int16 *)(a1 + 8) + 7i64) & 0xFFFFFFFFFFFFFFF8ui64) + a1 + 40),
        *(unsigned __int16 *)(a1 + 24));
      v13 = *(unsigned __int16 *)(a1 + 24);
      *((_WORD *)v9 + 36) = v13;
      *((_WORD *)v9 + 37) = v13 + 2;
      *(_WORD *)(v9[10] + 2 * (v13 >> 1)) = 0;
    }
    else
    {
      v3 = -1073741670;
    }
  }
  else
  {
LABEL_10:
    v3 = -1073741729;
  }
  ExReleaseResourceLite(v8);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v3;
}

Referenced by: