SepInformLsaOfDeletedLogon
VOID __fastcall SepInformLsaOfDeletedLogon(INT64 *a1, VOID *a2, CHAR *a3){
_QWORD *PoolWithTag;
INT64 v6;
PoolWithTag = a3;
if( !a3 )
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x40ui64, 0x774C6553ui64);
if( PoolWithTag )
{
v6 = *a1;
PoolWithTag[5] = 0i64;
*((_DWORD *)PoolWithTag + 12) = 0;
*((_DWORD *)PoolWithTag + 5) = 0;
PoolWithTag[3] = v6;
*((_DWORD *)PoolWithTag + 8) = 3;
*((_DWORD *)PoolWithTag + 9) = 8;
*((_DWORD *)PoolWithTag + 4) = 1;
PoolWithTag[7] = a2;
if( !SepQueueWorkItem((INT64)&SepLsaDeletedLogonQueueInfo, (INT64)PoolWithTag, 0i64) )
{
if( a2 )
ObfDereferenceObjectWithTag(a2, 0x734C6553ui64);
ExFreePoolWithTag(PoolWithTag, 0);
}
}
else if( a2 )
{
ObfDereferenceObjectWithTag(a2, 0x734C6553ui64);
}
}Referenced by:
SepDeReferenceLogonSession