SepAddTokenLogonSession

VOID __stdcall SepAddTokenLogonSession(_TOKEN *Token){
  INT64 v1; 
  _ETHREAD *CurrentThread; 
  unsigned int v4; 
  __int64 v5; 
  _ERESOURCE *v6; 
  __int64 *v7; 
  VOID **PoolWithTag; 
  VOID **v9; 
  VOID ***v10; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = (1529154084 * Token->AuthenticationId.LowPart) >> 28;
  --CurrentThread->Tcb.KernelApcDisable;
  v5 = v4;
  v6 = &stru_140CEC5A0 + (v4 & 3);
  ExAcquireResourceExclusiveLite((UINT64)v6, 1, v1);
  v7 = *(__int64 **)(SepLogonSessions + 8 * v5);
  if( v7 )
  {
    while( Token->AuthenticationId.LowPart != *((_DWORD *)v7 + 2)
         || Token->AuthenticationId.HighPart != *((_DWORD *)v7 + 3)
         || Token->LogonSession->ServerSilo != (_EJOB *)v7[20] )
    {
      v7 = (__int64 *)*v7;
      if( !v7 )
        goto LABEL_11;
    }
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x18ui64, 1934386515i64);
    if( PoolWithTag )
    {
      *PoolWithTag = 0i64;
      v9 = (VOID **)(v7 + 22);
      PoolWithTag[1] = 0i64;
      PoolWithTag[2] = Token;
      v10 = (VOID ***)v9[1];
      if( *v10 != v9 )
        __fastfail(3u);
      *PoolWithTag = v9;
      PoolWithTag[1] = v10;
      *v10 = PoolWithTag;
      v9[1] = PoolWithTag;
    }
  }
LABEL_11:
  ExReleaseResourceLite(v6);
  KeLeaveCriticalRegion();
}

Referenced by: