SepRmCallLsa

INT64 __fastcall SepRmCallLsa(INT64 a1){
  char v1; 
  int v3; 
  INT64 v4; 
  _ETHREAD *CurrentThread; 
  INT64 v6; 
  __int64 v7; 
  signed __int32 v8; 
  void *v9; 
  INT64 result; 
  _ETHREAD *v11; 
  __int64 v12; 
  __int64 v13; 
  int v14; 
  NTSTATUS v15; 
  struct _KEVENT *v16; 
  _QWORD *v17; 
  __int64 *v18; 
  struct _KEVENT *v19; 
  __int64 v20; 
  char pbPreventCoaf[8]; 
  HANDLE Object; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  _KAPC_STATE ApcState; 
  Object = 0i64;
  v1 = SepRmAuditingEnabled;
  memset(&ApcState, 0, sizeof(ApcState));
  v3 = 1;
  memset(&LockHandle, 0, sizeof(LockHandle));
  if( !AdtpRegisteredWithEtw )
  {
    SepAdtOpenEtwReadyEvent();
    if( (int)result < 0 )
      return result;
    v15 = NtWaitForSingleObject(Object, 1u, 0i64);
    NtClose(Object);
    if( v15 < 0 )
      return(unsigned int)v15;
  }
  if( v1 )
    KiStackAttachProcess((_KPROCESS *)SepRmLsaCallProcess, 0i64, &ApcState);
  do
  {
    v4 = 0i64;
    if( (*(_BYTE *)(a1 + 224) & 1) == 0 )
      goto LABEL_46;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquireResourceExclusiveLite((ERESOURCE *)(a1 + 32), 1u);
    v6 = *(_QWORD *)a1;
    if( *(_QWORD *)a1 == a1 )
    {
      v16 = *(struct _KEVENT **)(a1 + 192);
      if( v16 )
        KeSetEvent(v16, 0);
    }
    else if( *(_DWORD *)(v6 + 52) == *(_DWORD *)(a1 + 184) + 1 )
    {
      v4 = *(_QWORD *)a1;
      v7 = *(_QWORD *)v6;
      if( *(_QWORD *)(v6 + 8) != a1 || *(_QWORD *)(v7 + 8) != v6 )
LABEL_43:
        __fastfail(3u);
      *(_QWORD *)a1 = v7;
      *(_QWORD *)(v7 + 8) = a1;
    }
    ExReleaseResourceLite((PERESOURCE)(a1 + 32));
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    if( !v4 )
    {
LABEL_46:
      if( (*(_BYTE *)(a1 + 224) & 2) == 0 )
        continue;
      KeAcquireInStackQueuedSpinLock((UINT64 *)(a1 + 136), &LockHandle);
      v17 = (_QWORD *)(a1 + 16);
      v18 = *(__int64 **)(a1 + 16);
      if( v18 == (__int64 *)(a1 + 16) )
      {
        v19 = *(struct _KEVENT **)(a1 + 200);
        if( v19 )
          KeSetEvent(v19, 0);
      }
      else if( *((_DWORD *)v18 + 13) == *(_DWORD *)(a1 + 184) + 1 )
      {
        v4 = *(_QWORD *)(a1 + 16);
        v20 = *v18;
        if( (_QWORD *)v18[1] != v17 || *(__int64 **)(v20 + 8) != v18 )
          goto LABEL_43;
        *v17 = v20;
        *(_QWORD *)(v20 + 8) = v17;
      }
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      if( !v4 )
        continue;
    }
    if( *(_DWORD *)(v4 + 32) != 1 || (*(_DWORD *)(*(_QWORD *)(v4 + 24) + 20i64) & 2) != 0 )
    {
      if( v1 )
        SepRmDispatchDataToLsa(v4);
    }
    else
    {
      v11 = (_ETHREAD *)KeGetCurrentThread();
      v12 = *(_QWORD *)(v4 + 56);
      pbPreventCoaf[0] = 0;
      v13 = *((_QWORD *)v11 + 193);
      *((_QWORD *)v11 + 193) = v12;
      v14 = AdtpWriteToEtw(*(_SE_ADT_PARAMETER_ARRAY **)(v4 + 24), (UINT8 *)pbPreventCoaf);
      *((_QWORD *)KeGetCurrentThread() + 193) = v13;
      if( v14 < 0 )
      {
        LODWORD(SepAdtLastAuditFailStatus) = v14;
        _InterlockedIncrement(&SepAdtAuditFailureCount);
        if( !pbPreventCoaf[0] )
          SepAuditFailed((unsigned int)v14);
      }
      if( (unsigned int)(*(_DWORD *)(v4 + 16) - 4) <= 1 )
        ExFreePoolWithTag(*(PVOID *)(v4 + 24), 0);
    }
    _InterlockedIncrement((volatile signed __int32 *)(a1 + 184));
    v8 = _InterlockedExchangeAdd((volatile signed __int32 *)(a1 + 176), 0xFFFFFFFF);
    v9 = *(void **)(v4 + 56);
    v3 = v8 - 1;
    if( v9 )
    {
      ObfDereferenceObjectWithTag(v9, 0x69416553ui64);
      *(_QWORD *)(v4 + 56) = 0i64;
    }
    (*(void(__fastcall **)(INT64))(a1 + 216))(v4);
  }
  while( v3 );
  if( v1 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  return 0i64;
}

Referenced by: