SepCleanupMarkedForDeletionEntries
VOID __stdcall SepCleanupMarkedForDeletionEntries(){
RTL_DYNAMIC_HASH_TABLE *v0;
volatile LONG *SingletonEntryFromIndexNumber;
volatile LONG *v2;
KIRQL v3;
_DWORD *v4;
unsigned __int64 v5;
RTL_DYNAMIC_HASH_TABLE_ENTRY *v6;
unsigned int *v7;
struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator;
memset(&Enumerator, 0, sizeof(Enumerator));
v0 = *(RTL_DYNAMIC_HASH_TABLE **)(SeLuidToIndexMapping + 8);
RtlInitEnumerationHashTable(v0, &Enumerator);
while( 1 )
{
v6 = RtlEnumerateEntryHashTable(v0, &Enumerator);
v7 = (unsigned int *)v6;
if( !v6 )
break;
if( LOBYTE(v6[2].Linkage.Flink) && RtlRemoveEntryHashTable(v0, v6, 0i64) )
{
SingletonEntryFromIndexNumber = (volatile LONG *)SepGetSingletonEntryFromIndexNumber(v7[10]);
v2 = SingletonEntryFromIndexNumber;
if( SingletonEntryFromIndexNumber )
{
v3 = ExAcquireSpinLockExclusive(SingletonEntryFromIndexNumber);
v4 = (_DWORD *)*((_QWORD *)v2 + 2);
*((_QWORD *)v2 + 1) = 0i64;
v5 = v3;
if( v4 )
{
AuthzBasepFreeSecurityAttributesList(v4);
ExFreePoolWithTag(*((PVOID *)v2 + 2), 0x74446553u);
*((_QWORD *)v2 + 2) = 0i64;
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v2);
__writecr8(v5);
}
_bittestandreset(*(signed __int32 **)(SeLuidToIndexMapping + 24), v7[10]);
ExFreePoolWithTag(v7, 0);
}
}
RtlEndEnumerationHashTable(v0, &Enumerator);
}Referenced by:
SepAddLuidToIndexEntry