SepRmLsaConnectRequest

INT64 __fastcall SepRmLsaConnectRequest(_PORT_MESSAGE *pCommandMessage){
  int v1; 
  struct _DMA_ADAPTER *v2; 
  NTSTATUS v3; 
  _EJOB *ProcessServerSilo; 
  _SEP_RM_LSA_CONNECTION_STATE *v5; 
  UINT8 IsHostSilo; 
  __int64 v7; 
  NTSTATUS Section; 
  _EJOB *v9; 
  WCHAR v10; 
  NTSTATUS v11; 
  void *LsaCommandPortSectionHandle; 
  unsigned int v14; 
  struct _REMOTE_PORT_VIEW *HandleInformation; 
  void *ProcessHandle; 
  PVOID PortHandle; 
  struct _PORT_VIEW v18; 
  struct _UNICODE_STRING DestinationString; 
  struct _REMOTE_PORT_VIEW ClientView; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _SECURITY_QUALITY_OF_SERVICE SecurityQos; 
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  v1 = (int)pCommandMessage;
  *(_QWORD *)&SecurityQos.Length = 0i64;
  *(_DWORD *)&SecurityQos.ContextTrackingMode = 0;
  memset(&v18, 0, sizeof(v18));
  v2 = 0i64;
  ProcessHandle = 0i64;
  memset(&ObjectAttributes.RootDirectory, 0, 40);
  memset(&ClientView, 0, sizeof(ClientView));
  DestinationString = 0i64;
  if( ZwOpenProcess(&ProcessHandle, 0x28ui64, &ObjectAttributes, (CLIENT_ID *)((char *)pCommandMessage + 8)) >= 0 )
  {
    PortHandle = 0i64;
    v3 = ObReferenceObjectByHandle(ProcessHandle, 0, (POBJECT_TYPE)PsProcessType, 0, &PortHandle, 0i64);
    v2 = (struct _DMA_ADAPTER *)PortHandle;
    if( v3 >= 0 )
    {
      ProcessServerSilo = (_EJOB *)PsGetProcessServerSilo((__int64)PortHandle);
      v5 = (_SEP_RM_LSA_CONNECTION_STATE *)(PsGetServerSiloGlobals((__int64)ProcessServerSilo) + 98);
      if( !v5->LsaProcessHandle )
      {
        v5->LsaProcessHandle = ProcessHandle;
        SepRmVerifyLsaProtectionLevel(v5);
        ClientView.Length = 24;
        IsHostSilo = PsIsHostSilo(ProcessServerSilo);
        if( IsHostSilo )
        {
          v7 = -8i64;
        }
        else
        {
          ObfReferenceObjectWithTag(ProcessServerSilo, 0x74536553u);
          v7 = (__int64)ProcessServerSilo;
        }
        HandleInformation = &ClientView;
        Section = ZwAcceptConnectPort(&v5->RmCommandPortHandle, (PVOID)v7, v1);
        if( Section < 0 )
        {
          if( !IsHostSilo )
            ObfDereferenceObjectWithTag(ProcessServerSilo, 0x74536553ui64);
        }
        else
        {
          Section = ZwCompleteConnectPort(v5->RmCommandPortHandle);
          if( Section >= 0 )
          {
            SecurityQos.ImpersonationLevel = SecurityImpersonation;
            *(_WORD *)&SecurityQos.ContextTrackingMode = 257;
            LODWORD(HandleInformation) = 0x8000000;
            v5->LsaCommandPortSectionSize.LowPart = 4096;
            v5->LsaCommandPortSectionSize.HighPart = 0;
            Section = ZwCreateSection(
                        &v5->LsaCommandPortSectionHandle,
                        0xF001Fui64,
                        0i64,
                        &v5->LsaCommandPortSectionSize,
                        4ui64,
                        (UINT64)HandleInformation,
                        0i64);
            if( Section >= 0 )
            {
              v18.Length = 48;
              v18.SectionHandle = v5->LsaCommandPortSectionHandle;
              v18.SectionOffset = 0;
              v18.ViewSize = v5->LsaCommandPortSectionSize.LowPart;
              *(_OWORD *)&v18.ViewBase = 0i64;
              v9 = PsAttachSiloToCurrentThread(ProcessServerSilo);
              RtlInitUnicodeString(&DestinationString, L"\\SeLsaCommandPort", v10);
              ZwConnectPort();
              Section = v11;
              PsDetachSiloFromCurrentThread(v9);
              if( Section >= 0 )
                Section = -1073741823;
            }
          }
        }
        SepRmCleanupRmLsaState(v5);
        LsaCommandPortSectionHandle = v5->LsaCommandPortSectionHandle;
        if( LsaCommandPortSectionHandle )
        {
          ZwClose(LsaCommandPortSectionHandle);
          v5->LsaCommandPortSectionHandle = 0i64;
        }
        if( v2 )
          HalPutDmaAdapter(v2);
        return(unsigned int)Section;
      }
    }
    ZwClose(ProcessHandle);
  }
  PortHandle = 0i64;
  v14 = ZwAcceptConnectPort(&PortHandle, 0i64, v1);
  if( v2 )
    HalPutDmaAdapter(v2);
  return v14;
}

Referenced by: