SepDereferenceLowBoxNumberEntry

NTSTATUS __stdcall SepDereferenceLowBoxNumberEntry(UINT64 SessionId, PVOID P){
  unsigned int v2; 
  NTSTATUS TokenSessionMapEntry; 
  _ETHREAD *v5; 
  __int64 v6; 
  _EX_PUSH_LOCK *v8; 
  UINT8 v9; 
  VOID *v10; 
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *PushLock; 

  v2 = SessionId;
  PushLock = 0i64;
  TokenSessionMapEntry = 0;
  if( (unsigned int)SessionId >= 5 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockSharedEx(&stru_140C25D50, 0i64);
    TokenSessionMapEntry = SepGetTokenSessionMapEntry(v2, 0, (_SEP_LOWBOX_NUMBER_MAPPING **)&PushLock);
    if( _InterlockedCompareExchange64(&stru_140C25D50._bf_0, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(&stru_140C25D50);
    KeAbPostRelease(&stru_140C25D50);
    KeLeaveCriticalRegion();
  }
  else
  {
    PushLock = (_EX_PUSH_LOCK *)((char *)&unk_140C25C80 + 40 * (unsigned int)SessionId);
  }
  v5 = (_ETHREAD *)KeGetCurrentThread();
  --v5->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(PushLock, 0i64);
  v6 = _InterlockedDecrement64((volatile signed __int64 *)P + 3);
  if( v6 <= 0 )
  {
    if( v6 )
      __fastfail(0xEu);
    v8 = PushLock;
    v9 = RtlRemoveEntryHashTable((_RTL_DYNAMIC_HASH_TABLE *)PushLock[3]._bf_0, (_RTL_DYNAMIC_HASH_TABLE_ENTRY *)P, 0i64);
    if( v9 )
      _bittestandreset((signed __int32 *)v8[2]._bf_0, *((_DWORD *)P + 10) - 1);
    else
      TokenSessionMapEntry = -1073741823;
    if( (_InterlockedExchangeAdd64(&v8->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(PushLock);
    KeAbPostRelease(PushLock);
    KeLeaveCriticalRegion();
    if( v9 )
    {
      v10 = (VOID *)*((_QWORD *)P + 6);
      if( v10 )
      {
        ExRemoveLowBoxAtomReferences(v10, *((unsigned int *)P + 10));
        RtlDereferenceAtomTable(*((VOID **)P + 6));
        ExFreePoolWithTag(P, 0);
      }
    }
    return TokenSessionMapEntry;
  }
  else
  {
    if( (_InterlockedExchangeAdd64(&PushLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(PushLock);
    KeAbPostRelease(PushLock);
    KeLeaveCriticalRegion();
    return 0;
  }
}

Referenced by: