SepDeleteSessionLowboxEntries
VOID __stdcall SepDeleteSessionLowboxEntries(){
_ETHREAD *CurrentThread;
unsigned int v1;
volatile INT64 *i;
_ETHREAD *v3;
ULONG_PTR v4;
volatile INT64 *v5;
int v6;
__int64 v7;
int v8;
unsigned int v9;
_QWORD *v10;
unsigned int v11;
_QWORD *v12;
__int64 j;
unsigned __int64 v14;
int v15;
_ETHREAD *v16;
unsigned int v17;
char v18;
int v19;
bool v20;
__int64 v21;
unsigned __int64 v22;
__int64 v23;
volatile INT64 v24;
volatile INT64 **v25;
_ETHREAD *v26;
unsigned int SessionId;
char v28;
int v29;
__int64 v30;
unsigned __int64 v31;
__int64 v32;
_ETHREAD *v33;
char v34;
int v35;
__int64 v36;
unsigned __int64 v37;
__int64 v38;
int v39;
int v40;
int v41;
int v42;
int v43;
int v44;
if( g_SessionLowboxMap )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)&LowboxSessionMapLock, 0i64);
v1 = -1;
for( i = *(volatile INT64 **)g_SessionLowboxMap; i != (volatile INT64 *)g_SessionLowboxMap; i = v5 )
{
v3 = (_ETHREAD *)KeGetCurrentThread();
v4 = (ULONG_PTR)(i + 3);
v5 = (volatile INT64 *)*i;
--*((_WORD *)v3 + 242);
ExAcquirePushLockExclusiveEx((UINT64)(i + 3), 0i64);
v6 = *((_DWORD *)i + 8);
v7 = *((_QWORD *)i + 5);
v40 = 0;
v8 = (v7 & 4) != 0 ? 0x20 : 0;
v9 = v8 + v6 - 1;
v10 = (_QWORD *)(v7 - ((v7 & 4) != 0 ? 4 : 0));
if( v6 )
{
v12 = v10;
for( j = ~*v10 | ((1i64 << v8) - 1); j == -1; j = ~*v12 )
{
if( ++v12 > &v10[(unsigned __int64)v9 >> 6] )
{
v11 = -1;
goto LABEL_14;
}
}
_BitScanForward64(&v14, ~j);
v11 = v14 + ((unsigned int)(v12 - v10) << 6);
v40 = v14;
if( v11 > v9 )
v11 = -1;
}
else
{
v11 = -1;
}
LABEL_14:
v15 = v11 - v8;
if( v11 == -1 )
v15 = -1;
if( v15 == -1 )
{
RtlDeleteHashTable(*((RTL_DYNAMIC_HASH_TABLE **)i + 6));
ExFreePoolWithTag(*((PVOID *)i + 5), 0);
v24 = *i;
if( *(volatile INT64 **)(*i + 8) != i || (v25 = (volatile INT64 **)*((_QWORD *)i + 1), *v25 != i) )
__fastfail(3u);
*v25 = (volatile INT64 *)v24;
*(_QWORD *)(v24 + 8) = v25;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(i + 3);
v42 = 0;
v26 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)(i + 3)) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)v26 + 23));
else
SessionId = -1;
--*((_WORD *)v26 + 243);
v28 = ++*((_BYTE *)v26 + 794);
v29 = (*((char *)v26 + 792) | *((char *)v26 + 870)) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v30, v29);
v44 = v30;
if( v20 )
break;
v31 = *((_QWORD *)v26 + 100) + 96 * v30;
v29 &= ~(1 << v30);
if( (*(_BYTE *)(v31 + 26) & 1) != 0
&& (*(_DWORD *)(v31 + 32) & 1) == 0
&& (*(_QWORD *)(v31 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v31 + 40) == SessionId )
{
*(_BYTE *)(v31 + 26) &= ~1u;
if( *(_QWORD *)(v31 + 32) )
{
if( v31 )
{
*(_BYTE *)(v31 + 32) |= 2u;
if( *(__int64 *)(v31 + 32) < 0 )
KiAbEntryRemoveFromTree(v31);
v42 = 0;
v42 = *(_DWORD *)(v31 + 88) & 0x1FFFF;
*(_DWORD *)(v31 + 88) &= 0xFFFE0000;
*(_BYTE *)(v31 + 25) &= ~1u;
*(_QWORD *)(v31 + 32) = 0i64;
v32 = (__int64)(v31 - *((_QWORD *)v26 + 100)) / 96;
if( v28 == 1 )
*((_BYTE *)v26 + 792) |= 1 << v32;
else
_InterlockedOr8((volatile signed __int8 *)v26 + 870, 1 << v32);
goto LABEL_61;
}
break;
}
}
}
if( (*((_DWORD *)v26 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v26, (ULONG_PTR)(i + 3), SessionId, 0i64);
LABEL_61:
--*((_BYTE *)v26 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v26, (__int64)(i + 3), (unsigned int *)&v42);
v20 = (*((_WORD *)v26 + 243))++ == 0xFFFF;
if( v20 && *((_ETHREAD **)v26 + 19) != (_ETHREAD *)((char *)v26 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
ExFreePoolWithTag((PVOID)i, 0);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(i + 3);
v41 = 0;
v16 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)(i + 3)) == 1 )
v17 = MmGetSessionIdEx(*((_QWORD *)v16 + 23));
else
v17 = -1;
--*((_WORD *)v16 + 243);
v18 = ++*((_BYTE *)v16 + 794);
v19 = (*((char *)v16 + 792) | *((char *)v16 + 870)) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v21, v19);
v43 = v21;
if( v20 )
break;
v22 = *((_QWORD *)v16 + 100) + 96 * v21;
v19 &= ~(1 << v21);
if( (*(_BYTE *)(v22 + 26) & 1) != 0
&& (*(_DWORD *)(v22 + 32) & 1) == 0
&& (*(_QWORD *)(v22 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v22 + 40) == v17 )
{
*(_BYTE *)(v22 + 26) &= ~1u;
if( *(_QWORD *)(v22 + 32) )
{
if( v22 )
{
*(_BYTE *)(v22 + 32) |= 2u;
if( *(__int64 *)(v22 + 32) < 0 )
KiAbEntryRemoveFromTree(v22);
v41 = 0;
v41 = *(_DWORD *)(v22 + 88) & 0x1FFFF;
*(_DWORD *)(v22 + 88) &= 0xFFFE0000;
*(_BYTE *)(v22 + 25) &= ~1u;
*(_QWORD *)(v22 + 32) = 0i64;
v23 = (__int64)(v22 - *((_QWORD *)v16 + 100)) / 96;
if( v18 == 1 )
*((_BYTE *)v16 + 792) |= 1 << v23;
else
_InterlockedOr8((volatile signed __int8 *)v16 + 870, 1 << v23);
goto LABEL_34;
}
break;
}
}
}
if( (*((_DWORD *)v16 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v16, v4, v17, 0i64);
LABEL_34:
--*((_BYTE *)v16 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v16, v4, (unsigned int *)&v41);
v20 = (*((_WORD *)v16 + 243))++ == 0xFFFF;
if( v20 && *((_ETHREAD **)v16 + 19) != (_ETHREAD *)((char *)v16 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
}
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&LowboxSessionMapLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&LowboxSessionMapLock);
v39 = 0;
v33 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)&LowboxSessionMapLock) == 1 )
v1 = MmGetSessionIdEx(*((_QWORD *)v33 + 23));
--*((_WORD *)v33 + 243);
v34 = ++*((_BYTE *)v33 + 794);
v35 = (*((char *)v33 + 792) | *((char *)v33 + 870)) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v36, v35);
if( v20 )
break;
v37 = *((_QWORD *)v33 + 100) + 96 * v36;
v35 &= ~(1 << v36);
if( (*(_BYTE *)(v37 + 26) & 1) != 0
&& (*(_DWORD *)(v37 + 32) & 1) == 0
&& (*(_QWORD *)(v37 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&LowboxSessionMapLock & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v37 + 40) == v1 )
{
*(_BYTE *)(v37 + 26) &= ~1u;
if( *(_QWORD *)(v37 + 32) )
{
if( v37 )
{
*(_BYTE *)(v37 + 32) |= 2u;
if( *(__int64 *)(v37 + 32) < 0 )
KiAbEntryRemoveFromTree(v37);
v39 = *(_DWORD *)(v37 + 88) & 0x1FFFF;
*(_DWORD *)(v37 + 88) &= 0xFFFE0000;
*(_BYTE *)(v37 + 25) &= ~1u;
*(_QWORD *)(v37 + 32) = 0i64;
v38 = (__int64)(v37 - *((_QWORD *)v33 + 100)) / 96;
if( v34 == 1 )
*((_BYTE *)v33 + 792) |= 1 << v38;
else
_InterlockedOr8((volatile signed __int8 *)v33 + 870, 1 << v38);
goto LABEL_87;
}
break;
}
}
}
if( (*((_DWORD *)v33 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v33, (ULONG_PTR)&LowboxSessionMapLock, v1, 0i64);
LABEL_87:
--*((_BYTE *)v33 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v33, (__int64)&LowboxSessionMapLock, (unsigned int *)&v39);
v20 = (*((_WORD *)v33 + 243))++ == 0xFFFF;
if( v20 && *((_ETHREAD **)v33 + 19) != (_ETHREAD *)((char *)v33 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
}
}Referenced by:
SepDeReferenceLogonSession
SepDeleteLogonSessionTrack