SepRmDispatchDataToLsa

NTSTATUS __stdcall SepRmDispatchDataToLsa(_SEP_LSA_WORK_ITEM *WorkQueueItem){
  NTSTATUS v2; 
  _EJOB *v3; 
  _ESERVERSILO_GLOBALS *ServerSiloGlobals; 
  _SEP_RM_LSA_CONNECTION_STATE *p_SeRmSiloState; 
  __int16 v6; 
  _SEP_LSA_WORK_ITEM v7; 
  size_t v8; 
  NTSTATUS v9; 
  VOID *v10; 
  UINT64 v12; 
  VOID *v13; 
  VOID *LsaViewPortMemory; 
  NTSTATUS v15; 
  VOID *LsaBufferAddress; 
  UINT64 RegionSize; 
  _BYTE RequestMessage[512]; 
  _BYTE ReplyMessage[512]; 

  v2 = 0;
  memset(RequestMessage, 0i64, sizeof(RequestMessage));
  memset(ReplyMessage, 0i64, sizeof(ReplyMessage));
  v3 = (_EJOB *)*((_QWORD *)WorkQueueItem + 7);
  LsaBufferAddress = 0i64;
  ServerSiloGlobals = PsGetServerSiloGlobals(v3);
  p_SeRmSiloState = &ServerSiloGlobals->SeRmSiloState;
  if( ServerSiloGlobals->SeRmSiloState.LsaCommandPortHandle )
  {
    v6 = *((_WORD *)WorkQueueItem + 18);
    *(_DWORD *)&ReplyMessage[40] = 0;
    v7 = WorkQueueItem[4];
    *(_WORD *)&RequestMessage[2] = v6 + 48;
    *(_WORD *)RequestMessage = v6 + 8;
    *(_WORD *)ReplyMessage = *((_WORD *)WorkQueueItem + 24);
    *(_WORD *)&ReplyMessage[2] = *(_WORD *)ReplyMessage + 40;
    *(_DWORD *)&RequestMessage[40] = WorkQueueItem[8];
    if( v7 == 1 )
    {
      v8 = WorkQueueItem[9];
      *(_DWORD *)&RequestMessage[44] = 1;
      if( v8 <= 0x1D0 )
      {
        memmove(&RequestMessage[48], WorkQueueItem + 6, v8);
        goto LABEL_5;
      }
    }
    else if( (unsigned int)(v7 - 4) <= 2 )
    {
      v12 = (unsigned int)WorkQueueItem[9];
      v13 = (VOID *)*((_QWORD *)WorkQueueItem + 3);
      if( (unsigned int)v12 > 0x1D0 )
      {
        if( (unsigned int)v12 > 0x1000 )
        {
          v15 = SepAdtCopyToLsaSharedMemory(p_SeRmSiloState->LsaProcessHandle, v13, v12, &LsaBufferAddress);
          v2 = v15;
          if( v15 < 0 )
          {
            SepAuditFailed((unsigned int)v15);
LABEL_5:
            if( v2 >= 0 )
            {
              if( WorkQueueItem[8] != 3 || *((_QWORD *)WorkQueueItem + 5) )
                v9 = ZwRequestWaitReplyPort(
                       (UINT64)p_SeRmSiloState->LsaCommandPortHandle,
                       (__m256i *)RequestMessage,
                       (UINT64)ReplyMessage);
              else
                v9 = ZwRequestPort((UINT64)p_SeRmSiloState->LsaCommandPortHandle, (__m256i *)RequestMessage);
              v2 = v9;
              if( v9 >= 0 )
              {
                v10 = (VOID *)*((_QWORD *)WorkQueueItem + 5);
                if( v10 )
                  memmove(v10, &ReplyMessage[44], WorkQueueItem[12]);
                v2 = *(_DWORD *)&ReplyMessage[40];
              }
              if( *(_DWORD *)&RequestMessage[44] == 3 )
              {
                RegionSize = 0i64;
                return ZwFreeVirtualMemory(
                         p_SeRmSiloState->LsaProcessHandle,
                         (VOID **)&RequestMessage[48],
                         &RegionSize,
                         0x8000ui64);
              }
            }
            return v2;
          }
          LsaViewPortMemory = LsaBufferAddress;
          *(_DWORD *)&RequestMessage[44] = 3;
        }
        else
        {
          memmove(p_SeRmSiloState->RmViewPortMemory, v13, v12);
          LsaViewPortMemory = p_SeRmSiloState->LsaViewPortMemory;
          *(_DWORD *)&RequestMessage[44] = 2;
        }
        v7 = WorkQueueItem[4];
        *(_QWORD *)&RequestMessage[48] = LsaViewPortMemory;
        *(_DWORD *)RequestMessage = 3670032;
      }
      else
      {
        memmove(&RequestMessage[48], v13, v12);
        *(_DWORD *)&RequestMessage[44] = 1;
      }
      if( (unsigned int)(v7 - 4) <= 1 )
        ExFreePoolWithTag(*((PVOID *)WorkQueueItem + 3), 0);
      goto LABEL_5;
    }
    return -1073741811;
  }
  return 0;
}

Referenced by: