SepCleanupLUIDDeviceMapDirectory

NTSTATUS __stdcall SepCleanupLUIDDeviceMapDirectory(_LUID *pLogonId, _EJOB *ServerSilo){
  _UNICODE_STRING *v4; 
  unsigned int v5; 
  INT8 v6; 
  unsigned int ServerSiloServiceSessionId; 
  _EJOB *v8; 
  _EJOB *v9; 
  int v10; 
  VOID **PoolWithTag; 
  NTSTATUS RestartScan; 
  __int64 v13; 
  UINT64 v14; 
  NTSTATUS v15; 
  VOID **v16; 
  VOID **v18; 
  INT8 v19; 
  UINT64 NumberOfBytes; 
  VOID *DirectoryHandle; 
  VOID *LinkHandle; 
  UINT64 Context; 
  _EJOB *PreviousSilo; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _UNICODE_STRING DestinationString; 
  _KAPC_STATE ApcState; 
  WCHAR Dst[64]; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  LinkHandle = 0i64;
  v4 = 0i64;
  LODWORD(Context) = 0;
  v5 = 100;
  NumberOfBytes = 0i64;
  DirectoryHandle = 0i64;
  DestinationString = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  if( !pLogonId )
    return -1073741811;
  v19 = ObReferenceObjectSafeWithTag((INT64)KeGetCurrentThread()->ApcState.Process, 1297245523i64);
  v6 = v19;
  if( v19 )
    ObfDereferenceObjectWithTag(KeGetCurrentThread()->ApcState.Process, 0x4D526553ui64);
  else
    KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
  ServerSiloServiceSessionId = PsGetServerSiloServiceSessionId((INT64)ServerSilo);
  swprintf_s(
    Dst,
    0x40ui64,
    (WCHAR *)L"\\Sessions\\%d\\DosDevices\\%08x-%08x",
    ServerSiloServiceSessionId,
    pLogonId->HighPart,
    pLogonId->LowPart);
  RtlInitUnicodeString(&DestinationString, Dst);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.Attributes = 576;
  LODWORD(v8) = PsAttachSiloToCurrentThread((INT64)ServerSilo);
  PreviousSilo = v8;
  v9 = v8;
  v10 = ZwOpenDirectoryObject(&DirectoryHandle, 1, &ObjectAttributes);
  if( v10 < 0 )
  {
    PsDetachSiloFromCurrentThread(v9);
    if( !v19 )
      KiUnstackDetachProcess(&ApcState, 0i64);
    return v10;
  }
  else
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x320ui64, 1632134483i64);
    if( PoolWithTag )
    {
LABEL_6:
      LOBYTE(RestartScan) = 1;
      v13 = 0i64;
      while( 1 )
      {
        LODWORD(v14) = HIDWORD(NumberOfBytes);
        do
        {
          v15 = ZwQueryDirectoryObject(
                  DirectoryHandle,
                  v4,
                  (unsigned int)v14,
                  1u,
                  RestartScan,
                  &Context,
                  &NumberOfBytes);
          if( v15 == -1073741789 )
          {
            v14 = (unsigned int)NumberOfBytes;
            if( v4 )
              ExFreePoolWithTag(v4, 0);
            v4 = (_UNICODE_STRING *)ExAllocatePoolWithTag(1ui64, v14, 1648649555i64);
            if( !v4 )
              v15 = -1073741670;
          }
        }
        while( v15 == -1073741789 );
        RestartScan = 0;
        HIDWORD(NumberOfBytes) = v14;
        v6 = v19;
        if( v15 < 0 )
          break;
        if( !wcscmp(v4[1].Buffer, (PWCHAR)L"SymbolicLink") )
        {
          if( (unsigned int)v13 >= v5 )
          {
            if( (_DWORD)v13 )
            {
              v18 = PoolWithTag;
              do
              {
                ZwClose((_HANDLE)*v18++);
                --v13;
              }
              while( v13 );
            }
            v5 += 20;
            ExFreePoolWithTag(PoolWithTag, 0);
            PoolWithTag = ExAllocatePoolWithTag(1ui64, 8i64 * v5, 1632134483i64);
            if( !PoolWithTag )
            {
              v9 = PreviousSilo;
              goto LABEL_44;
            }
            goto LABEL_6;
          }
          ObjectAttributes.RootDirectory = DirectoryHandle;
          ObjectAttributes.Length = 48;
          ObjectAttributes.Attributes = 576;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          ObjectAttributes.ObjectName = v4;
          if( ZwOpenSymbolicLinkObject(&LinkHandle, 983041, &ObjectAttributes) >= 0 )
          {
            if( ZwMakeTemporaryObject(LinkHandle) < 0 )
            {
              ZwClose((_HANDLE)LinkHandle);
            }
            else
            {
              PoolWithTag[v13] = LinkHandle;
              v13 = (unsigned int)(v13 + 1);
            }
          }
        }
      }
      if( v15 != -2147483622 )
        RestartScan = v15;
      if( (_DWORD)v13 )
      {
        v16 = PoolWithTag;
        do
        {
          ZwClose((_HANDLE)*v16++);
          --v13;
        }
        while( v13 );
      }
      ExFreePoolWithTag(PoolWithTag, 0);
      if( v4 )
        ExFreePoolWithTag(v4, 0);
      if( DirectoryHandle )
        ZwClose((_HANDLE)DirectoryHandle);
      PsDetachSiloFromCurrentThread(PreviousSilo);
      if( !v19 )
        KiUnstackDetachProcess(&ApcState, 0i64);
      return RestartScan;
    }
    else
    {
LABEL_44:
      ZwClose((_HANDLE)DirectoryHandle);
      if( v4 )
        ExFreePoolWithTag(v4, 0);
      PsDetachSiloFromCurrentThread(v9);
      if( !v6 )
        KiUnstackDetachProcess(&ApcState, 0i64);
      return -1073741801;
    }
  }
}

Referenced by: