SepCleanupLUIDDeviceMapDirectory

INT64 __fastcall SepCleanupLUIDDeviceMapDirectory(_LUID *pLogonId, _EJOB *ServerSilo){
  _UNICODE_STRING *v3; 
  unsigned int v4; 
  UINT8 v5; 
  WCHAR v6; 
  _EJOB *v7; 
  NTSTATUS v8; 
  HANDLE *PoolWithTag; 
  unsigned int RestartScan; 
  __int64 v11; 
  UINT64 v12; 
  NTSTATUS v13; 
  HANDLE *v14; 
  HANDLE *v16; 
  UINT8 v17; 
  UINT64 ReturnLength; 
  void *DirectoryHandle; 
  void *LinkHandle; 
  UINT64 Context; 
  _EJOB *PreviousSilo; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _UNICODE_STRING DestinationString; 
  _KAPC_STATE ApcState; 
  wchar_t Dst[64]; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  LinkHandle = 0i64;
  v3 = 0i64;
  LODWORD(Context) = 0;
  v4 = 100;
  ReturnLength = 0i64;
  DirectoryHandle = 0i64;
  DestinationString = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  if( !pLogonId )
    return 3221225485i64;
  v17 = ObReferenceObjectSafeWithTag(*((PVOID *)KeGetCurrentThread() + 23), 0x4D526553ui64);
  v5 = v17;
  if( v17 )
    ObfDereferenceObjectWithTag(*((PVOID *)KeGetCurrentThread() + 23), 0x4D526553ui64);
  else
    KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
  PsGetServerSiloServiceSessionId(ServerSilo);
  swprintf_s(Dst, 0x40ui64, (WCHAR *)L"\\Sessions\\%d\\DosDevices\\%08x-%08x");
  RtlInitUnicodeString(&DestinationString, Dst, v6);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.Attributes = 576;
  PreviousSilo = PsAttachSiloToCurrentThread(ServerSilo);
  v7 = PreviousSilo;
  v8 = ZwOpenDirectoryObject(&DirectoryHandle, 1ui64, &ObjectAttributes);
  if( v8 < 0 )
  {
    PsDetachSiloFromCurrentThread(v7);
    if( !v17 )
      KiUnstackDetachProcess(&ApcState, 0i64);
    return(unsigned int)v8;
  }
  else
  {
    PoolWithTag = (HANDLE *)ExAllocatePoolWithTag(PagedPool, 0x320ui64, 0x61486553ui64);
    if( PoolWithTag )
    {
LABEL_6:
      LOBYTE(RestartScan) = 1;
      v11 = 0i64;
      while( 1 )
      {
        LODWORD(v12) = HIDWORD(ReturnLength);
        do
        {
          v13 = ZwQueryDirectoryObject(DirectoryHandle, v3, (unsigned int)v12, 1u, RestartScan, &Context, &ReturnLength);
          if( v13 == -1073741789 )
          {
            v12 = (unsigned int)ReturnLength;
            if( v3 )
              ExFreePoolWithTag(v3, 0);
            v3 = (_UNICODE_STRING *)ExAllocatePoolWithTag(PagedPool, v12, 0x62446553ui64);
            if( !v3 )
              v13 = -1073741670;
          }
        }
        while( v13 == -1073741789 );
        RestartScan = 0;
        HIDWORD(ReturnLength) = v12;
        v5 = v17;
        if( v13 < 0 )
          break;
        if( !wcscmp(v3[1].Buffer, (PWCHAR)L"SymbolicLink") )
        {
          if( (unsigned int)v11 >= v4 )
          {
            if( (_DWORD)v11 )
            {
              v16 = PoolWithTag;
              do
              {
                ZwClose(*v16++);
                --v11;
              }
              while( v11 );
            }
            v4 += 20;
            ExFreePoolWithTag(PoolWithTag, 0);
            PoolWithTag = (HANDLE *)ExAllocatePoolWithTag(PagedPool, 8i64 * v4, 0x61486553ui64);
            if( !PoolWithTag )
            {
              v7 = PreviousSilo;
              goto LABEL_44;
            }
            goto LABEL_6;
          }
          ObjectAttributes.RootDirectory = DirectoryHandle;
          ObjectAttributes.Length = 48;
          ObjectAttributes.Attributes = 576;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          ObjectAttributes.ObjectName = v3;
          if( ZwOpenSymbolicLinkObject(&LinkHandle, 0xF0001ui64, &ObjectAttributes) >= 0 )
          {
            if( ZwMakeTemporaryObject(LinkHandle) < 0 )
            {
              ZwClose(LinkHandle);
            }
            else
            {
              PoolWithTag[v11] = LinkHandle;
              v11 = (unsigned int)(v11 + 1);
            }
          }
        }
      }
      if( v13 != -2147483622 )
        RestartScan = v13;
      if( (_DWORD)v11 )
      {
        v14 = PoolWithTag;
        do
        {
          ZwClose(*v14++);
          --v11;
        }
        while( v11 );
      }
      ExFreePoolWithTag(PoolWithTag, 0);
      if( v3 )
        ExFreePoolWithTag(v3, 0);
      if( DirectoryHandle )
        ZwClose(DirectoryHandle);
      PsDetachSiloFromCurrentThread(PreviousSilo);
      if( !v17 )
        KiUnstackDetachProcess(&ApcState, 0i64);
      return RestartScan;
    }
    else
    {
LABEL_44:
      ZwClose(DirectoryHandle);
      if( v3 )
        ExFreePoolWithTag(v3, 0);
      PsDetachSiloFromCurrentThread(v7);
      if( !v5 )
        KiUnstackDetachProcess(&ApcState, 0i64);
      return 3221225495i64;
    }
  }
}

Referenced by: