SepRmDispatchDataToLsa

INT64 __fastcall SepRmDispatchDataToLsa(INT64 a1){
  int v2; 
  __int64 v3; 
  __int64 *ServerSiloGlobals; 
  __int64 *v5; 
  __int16 v6; 
  int v7; 
  unsigned int v8; 
  int v9; 
  UINT8 *v10; 
  UINT64 v12; 
  VOID *v13; 
  void *v14; 
  int v15; 
  VOID *LsaBufferAddress; 
  ULONG_PTR RegionSize; 
  INT64 result; 
  int v19; 
  int v20; 
  PVOID BaseAddress[58]; 
  _WORD v22[20]; 
  int v23; 
  UINT8 Src[468]; 
  v2 = 0;
  memset((INT64)&result, 0i64);
  memset((INT64)v22, 0i64);
  v3 = *(_QWORD *)(a1 + 56);
  LsaBufferAddress = 0i64;
  ServerSiloGlobals = PsGetServerSiloGlobals(v3);
  v5 = ServerSiloGlobals + 98;
  if( ServerSiloGlobals[99] )
  {
    v6 = *(_WORD *)(a1 + 36);
    v23 = 0;
    v7 = *(_DWORD *)(a1 + 16);
    WORD1(result) = v6 + 48;
    LOWORD(result) = v6 + 8;
    v22[0] = *(_WORD *)(a1 + 48);
    v22[1] = v22[0] + 40;
    v19 = *(_DWORD *)(a1 + 32);
    if( v7 == 1 )
    {
      v8 = *(_DWORD *)(a1 + 36);
      v20 = 1;
      if( v8 <= 0x1D0 )
      {
        memmove((UINT8 *)BaseAddress, (UINT8 *)(a1 + 24), v8);
        goto LABEL_5;
      }
    }
    else if( (unsigned int)(v7 - 4) <= 2 )
    {
      v12 = *(unsigned int *)(a1 + 36);
      v13 = *(VOID **)(a1 + 24);
      if( (unsigned int)v12 > 0x1D0 )
      {
        if( (unsigned int)v12 > 0x1000 )
        {
          v15 = SepAdtCopyToLsaSharedMemory((VOID *)*v5, v13, v12, &LsaBufferAddress);
          v2 = v15;
          if( v15 < 0 )
          {
            SepAuditFailed((unsigned int)v15);
LABEL_5:
            if( v2 >= 0 )
            {
              if( *(_DWORD *)(a1 + 32) != 3 || *(_QWORD *)(a1 + 40) )
                v9 = ZwRequestWaitReplyPort();
              else
                v9 = ZwRequestPort();
              v2 = v9;
              if( v9 >= 0 )
              {
                v10 = *(UINT8 **)(a1 + 40);
                if( v10 )
                  memmove(v10, Src, *(unsigned int *)(a1 + 48));
                v2 = v23;
              }
              if( v20 == 3 )
              {
                RegionSize = 0i64;
                return(unsigned int)ZwFreeVirtualMemory((PVOID)*v5, BaseAddress, &RegionSize, 0x8000ui64);
              }
            }
            return(unsigned int)v2;
          }
          v14 = LsaBufferAddress;
          v20 = 3;
        }
        else
        {
          memmove((UINT8 *)v5[8], (UINT8 *)v13, v12);
          v14 = (void *)v5[7];
          v20 = 2;
        }
        v7 = *(_DWORD *)(a1 + 16);
        BaseAddress[0] = v14;
        LODWORD(result) = 3670032;
      }
      else
      {
        memmove((UINT8 *)BaseAddress, (UINT8 *)v13, v12);
        v20 = 1;
      }
      if( (unsigned int)(v7 - 4) <= 1 )
        ExFreePoolWithTag(*(PVOID *)(a1 + 24), 0);
      goto LABEL_5;
    }
    return(unsigned int)-1073741811;
  }
  return 0i64;
}

Referenced by:

SepAdtLogAuditRecord
SepRmCallLsa