SepDeReferenceLogonSession

VOID __fastcall SepDeReferenceLogonSession(_LUID *LogonId, _EJOB *ServerSilo){
  __int64 v4; 
  INT64 *v5; 
  _ETHREAD *CurrentThread; 
  struct _ERESOURCE *v7; 
  INT64 i; 
  __int64 v9; 
  struct _DMA_ADAPTER *v10; 
  _DEVICE_MAP *v11; 
  void *v12; 
  v4 = (1529154084 * LogonId->LowPart) >> 28;
  v5 = (INT64 *)(SepLogonSessions + 8 * v4);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v7 = &SepRmDbLock + (v4 & 3);
  ExAcquireResourceExclusiveLite(v7, 1u);
  for( i = *v5; ; i = *(_QWORD *)i )
  {
    if( !i )
    {
      ExReleaseResourceLite(v7);
      KeLeaveCriticalRegion();
      KeBugCheckEx(0x46u, 0i64, 0i64, 0i64, 0i64);
    }
    if( *(_EJOB **)(i + 160) == ServerSilo
      && LogonId->LowPart == *(_DWORD *)(i + 8)
      && LogonId->HighPart == *(_DWORD *)(i + 12) )
    {
      break;
    }
    v5 = (INT64 *)i;
  }
  v9 = _InterlockedDecrement64((volatile signed __int64 *)(i + 24));
  if( v9 > 0 )
  {
    ExReleaseResourceLite(v7);
    KeLeaveCriticalRegion();
  }
  else
  {
    if( v9 )
      __fastfail(0xEu);
    *v5 = *(_QWORD *)i;
    ExReleaseResourceLite(v7);
    KeLeaveCriticalRegion();
    if( (*(_DWORD *)(i + 32) & 4) != 0 && (*(_DWORD *)(i + 16) || *(_DWORD *)(i + 20)) )
      SepDeReferenceLogonSession((_LUID *)(i + 16), *(_EJOB **)(i + 160));
    v10 = *(struct _DMA_ADAPTER **)(i + 48);
    if( v10 )
    {
      HalPutDmaAdapter(v10);
      *(_QWORD *)(i + 48) = 0i64;
    }
    v11 = *(_DEVICE_MAP **)(i + 40);
    if( v11 )
    {
      *(_QWORD *)(i + 40) = 0i64;
      SepCleanupLUIDDeviceMapDirectory(LogonId, ServerSilo);
      ObfDereferenceDeviceMap(v11);
    }
    if( (*(_DWORD *)(i + 32) & 1) != 0 )
      SepInformFileSystemsOfDeletedLogon(LogonId, ServerSilo);
    v12 = *(void **)(i + 64);
    if( v12 )
      ExFreePoolWithTag(v12, 0);
    SepDeleteLogonSessionClaims(i);
    if( SepTokenSidSharingEnabled )
      SepDeleteLogonSessionSidValues(i);
    ObDestroyHandleRevocationBlock((_OB_HANDLE_REVOCATION_BLOCK *)(i + 128));
    SepInformLsaOfDeletedLogon((INT64 *)LogonId, *(VOID **)(i + 160), (CHAR *)i);
    SepDeleteSessionLowboxEntries();
  }
}

Referenced by: