SepMakeLogonSessionsSiblings

NTSTATUS __stdcall SepMakeLogonSessionsSiblings(_LUID *AuthId, _LUID *SiblingAuthId){
  _ETHREAD *CurrentThread; 
  __int64 v5; 
  __int64 v6; 
  INT64 v7; 
  __int64 v8; 
  __int64 v9; 
  _ERESOURCE *v10; 
  __int64 **v11; 
  _ERESOURCE *v12; 
  INT64 v13; 
  UINT64 v14; 
  _ETHREAD *v15; 
  NTSTATUS v16; 
  __int64 *i; 
  _LUID v18; 
  _LUID v19; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = (1529154084 * AuthId->LowPart) >> 28;
  v6 = (1529154084 * SiblingAuthId->LowPart) >> 28;
  v7 = v5 & 3;
  v8 = v6 & 3;
  v9 = SepLogonSessions + 8 * v5;
  v10 = &stru_140CEC5A0 + v7;
  v11 = (__int64 **)(SepLogonSessions + 8 * v6);
  v12 = &stru_140CEC5A0 + v8;
  --CurrentThread->Tcb.KernelApcDisable;
  if( (unsigned int)v5 >= (unsigned int)v6 )
  {
    ExAcquireResourceExclusiveLite((UINT64)(&stru_140CEC5A0 + v8), 1, v7);
    v14 = (UINT64)v10;
  }
  else
  {
    ExAcquireResourceExclusiveLite((UINT64)(&stru_140CEC5A0 + v7), 1, v7);
    v14 = (UINT64)v12;
  }
  v15 = (_ETHREAD *)KeGetCurrentThread();
  --v15->Tcb.KernelApcDisable;
  ExAcquireResourceExclusiveLite(v14, 1, v13);
  v16 = 0;
  do
    v9 = *(_QWORD *)v9;
  while( v9
       && (*(_EJOB **)(v9 + 160) != PsGetCurrentServerSilo()
        || AuthId->LowPart != *(_DWORD *)(v9 + 8)
        || AuthId->HighPart != *(_DWORD *)(v9 + 12)) );
  for( i = *v11;
        i
     && ((_EJOB *)i[20] != PsGetCurrentServerSilo()
      || SiblingAuthId->LowPart != *((_DWORD *)i + 2)
      || SiblingAuthId->HighPart != *((_DWORD *)i + 3));
        i = (__int64 *)*i )
  {
    ;
  }
  if( v9 && i )
  {
    v18 = *SiblingAuthId;
    *(_DWORD *)(v9 + 32) |= 0x40u;
    *(_LUID *)(v9 + 168) = v18;
    v19 = *AuthId;
    *((_DWORD *)i + 8) |= 0x40u;
    i[21] = (__int64)v19;
  }
  else
  {
    v16 = -1073741729;
  }
  ExReleaseResourceLite(v10);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  ExReleaseResourceLite(v12);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v16;
}

Referenced by:

SepRmMakeLogonSessionsSiblingsWrkr