SepRmCallLsa

VOID __stdcall SepRmCallLsa(INT64 **a1){
  INT64 v1; 
  char v2; 
  int v4; 
  INT64 *v5; 
  _ETHREAD *CurrentThread; 
  INT64 *v7; 
  INT64 *v8; 
  signed __int32 v9; 
  VOID *v10; 
  _ETHREAD *v11; 
  _EJOB *v12; 
  _LIST_ENTRY *Silo; 
  NTSTATUS v14; 
  NTSTATUS v15; 
  _KEVENT *v16; 
  INT64 **v17; 
  INT64 *v18; 
  _KEVENT *v19; 
  INT64 *v20; 
  char pbPreventCoaf[8]; 
  VOID *Handle; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  _KAPC_STATE ApcState; 

  Handle = 0i64;
  v2 = SepRmAuditingEnabled;
  memset(&ApcState, 0, sizeof(ApcState));
  v4 = 1;
  memset(&LockHandle, 0, sizeof(LockHandle));
  if( AdtpRegisteredWithEtw
    || SepAdtOpenEtwReadyEvent(&Handle) >= 0
    && (v15 = NtWaitForSingleObject((UINT64)Handle, 1, 0i64), NtClose((UINT64)Handle), v15 >= 0) )
  {
    if( v2 )
      KiStackAttachProcess(SepRmLsaCallProcess, 0i64, &ApcState);
    do
    {
      v5 = 0i64;
      if( ((_BYTE)a1[28] & 1) == 0 )
        goto LABEL_45;
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquireResourceExclusiveLite((UINT64)(a1 + 4), 1, v1);
      v7 = *a1;
      if( *a1 == (INT64 *)a1 )
      {
        v16 = (_KEVENT *)a1[24];
        if( v16 )
          KeSetEvent(v16, 0, 0);
      }
      else if( *((_DWORD *)v7 + 13) == *((_DWORD *)a1 + 46) + 1 )
      {
        v5 = *a1;
        v8 = (INT64 *)*v7;
        if( (INT64 **)v7[1] != a1 || (INT64 *)v8[1] != v7 )
LABEL_42:
          __fastfail(3u);
        *a1 = v8;
        v8[1] = (INT64)a1;
      }
      ExReleaseResourceLite((PERESOURCE)(a1 + 4));
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      if( !v5 )
      {
LABEL_45:
        if( ((_BYTE)a1[28] & 2) == 0 )
          continue;
        KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)a1 + 17, &LockHandle);
        v17 = a1 + 2;
        v18 = a1[2];
        if( v18 == (INT64 *)(a1 + 2) )
        {
          v19 = (_KEVENT *)a1[25];
          if( v19 )
            KeSetEvent(v19, 0, 0);
        }
        else if( *((_DWORD *)v18 + 13) == *((_DWORD *)a1 + 46) + 1 )
        {
          v5 = a1[2];
          v20 = (INT64 *)*v18;
          if( (INT64 **)v18[1] != v17 || (INT64 *)v20[1] != v18 )
            goto LABEL_42;
          *v17 = v20;
          v20[1] = (INT64)v17;
        }
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
        __writecr8(LockHandle.OldIrql);
        if( !v5 )
          continue;
      }
      if( *((_DWORD *)v5 + 8) != 1 || (*(_DWORD *)(v5[3] + 20) & 2) != 0 )
      {
        if( v2 )
          SepRmDispatchDataToLsa((_SEP_LSA_WORK_ITEM *)v5);
      }
      else
      {
        v11 = (_ETHREAD *)KeGetCurrentThread();
        v12 = (_EJOB *)v5[7];
        pbPreventCoaf[0] = 0;
        Silo = (_LIST_ENTRY *)v11->Silo;
        v11->Silo = v12;
        v14 = AdtpWriteToEtw((_SE_ADT_PARAMETER_ARRAY *)v5[3], (UINT8 *)pbPreventCoaf);
        KeGetCurrentThread()[1].WaitBlock[3].WaitListEntry.Blink = Silo;
        if( v14 < 0 )
        {
          LODWORD(SepAdtLastAuditFailStatus) = v14;
          _InterlockedIncrement((_DWORD *)&stru_140CF2E80 + 1957);
          if( !pbPreventCoaf[0] )
            SepAuditFailed((unsigned int)v14);
        }
        if( (unsigned int)(*((_DWORD *)v5 + 4) - 4) <= 1 )
          ExFreePoolWithTag((PVOID)v5[3], 0);
      }
      _InterlockedIncrement((volatile signed __int32 *)a1 + 46);
      v9 = _InterlockedExchangeAdd((volatile signed __int32 *)a1 + 44, 0xFFFFFFFF);
      v10 = (VOID *)v5[7];
      v4 = v9 - 1;
      if( v10 )
      {
        ObfDereferenceObjectWithTag(v10, 0x69416553ui64);
        v5[7] = 0i64;
      }
      ((void(__fastcall *)(INT64 *))a1[27])(v5);
    }
    while( v4 );
    if( v2 )
      KiUnstackDetachProcess(&ApcState, 0i64);
  }
}

Referenced by: