SepMakeLogonSessionsSiblings
NTSTATUS __stdcall SepMakeLogonSessionsSiblings(_LUID *AuthId, _LUID *SiblingAuthId){
_ETHREAD *CurrentThread;
__int64 v5;
__int64 v6;
INT64 v7;
__int64 v8;
__int64 v9;
_ERESOURCE *v10;
__int64 **v11;
_ERESOURCE *v12;
INT64 v13;
UINT64 v14;
_ETHREAD *v15;
NTSTATUS v16;
__int64 *i;
_LUID v18;
_LUID v19;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v5 = (1529154084 * AuthId->LowPart) >> 28;
v6 = (1529154084 * SiblingAuthId->LowPart) >> 28;
v7 = v5 & 3;
v8 = v6 & 3;
v9 = SepLogonSessions + 8 * v5;
v10 = &stru_140CEC5A0 + v7;
v11 = (__int64 **)(SepLogonSessions + 8 * v6);
v12 = &stru_140CEC5A0 + v8;
--CurrentThread->Tcb.KernelApcDisable;
if( (unsigned int)v5 >= (unsigned int)v6 )
{
ExAcquireResourceExclusiveLite((UINT64)(&stru_140CEC5A0 + v8), 1, v7);
v14 = (UINT64)v10;
}
else
{
ExAcquireResourceExclusiveLite((UINT64)(&stru_140CEC5A0 + v7), 1, v7);
v14 = (UINT64)v12;
}
v15 = (_ETHREAD *)KeGetCurrentThread();
--v15->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite(v14, 1, v13);
v16 = 0;
do
v9 = *(_QWORD *)v9;
while( v9
&& (*(_EJOB **)(v9 + 160) != PsGetCurrentServerSilo()
|| AuthId->LowPart != *(_DWORD *)(v9 + 8)
|| AuthId->HighPart != *(_DWORD *)(v9 + 12)) );
for( i = *v11;
i
&& ((_EJOB *)i[20] != PsGetCurrentServerSilo()
|| SiblingAuthId->LowPart != *((_DWORD *)i + 2)
|| SiblingAuthId->HighPart != *((_DWORD *)i + 3));
i = (__int64 *)*i )
{
;
}
if( v9 && i )
{
v18 = *SiblingAuthId;
*(_DWORD *)(v9 + 32) |= 0x40u;
*(_LUID *)(v9 + 168) = v18;
v19 = *AuthId;
*((_DWORD *)i + 8) |= 0x40u;
i[21] = (__int64)v19;
}
else
{
v16 = -1073741729;
}
ExReleaseResourceLite(v10);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
ExReleaseResourceLite(v12);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
return v16;
}Referenced by:
SepRmMakeLogonSessionsSiblingsWrkr