SepRmCommandServerThread

VOID __stdcall SepRmCommandServerThread(VOID *StartContext){
  NTSTATUS v1; 
  _RM_REPLY_MESSAGE *v2; 
  NTSTATUS v3; 
  PKINTERRUPT_ROUTINE **v4; 
  UINT32 v5; 
  PKINTERRUPT_ROUTINE *v6; 
  _EJOB *v7; 
  __int64 v8; 
  __int16 v9; 
  _EJOB *v10; 
  _EJOB *v11; 
  _ETHREAD *CurrentThread; 
  INT64 v13; 
  bool v14; 
  UINT8 inited; 
  _ETHREAD *v16; 
  UINT8 v17; 
  INT64 v18; 
  bool v19; 
  _ESERVERSILO_GLOBALS *ServerSiloGlobals; 
  INT64 v21; 
  INT64 v22; 
  __m256i Silo; 
  __int128 Object_8; 
  INT64 v25[3]; 
  __int64 v26; 
  _RM_COMMAND_MESSAGE CommandMessage; 
  int v28; 
  _BYTE v29[504]; 
  _RM_REPLY_MESSAGE ReplyMessage[128]; 

  memset(v29, 0i64, sizeof(v29));
  memset(&ReplyMessage[2], 0i64, 0x1F8u);
  Silo.m256i_i64[0] = 0i64;
  SepRmLsaCallProcess = KeGetCurrentThread()->ApcState.Process;
  ObfReferenceObject(SepRmLsaCallProcess);
  v1 = PoRequestShutdownEvent(0i64);
  if( v1 < 0 )
  {
    ZwClose(PortHandle);
    PortHandle = 0i64;
    SepAuditFailed((unsigned int)v1);
  }
  else
  {
    v28 = 0;
    ReplyMessage[1] = 0;
    v2 = 0i64;
    CommandMessage = 33554904;
    ReplyMessage[0] = 33554904;
    while( 1 )
    {
      while( 1 )
      {
        while( 1 )
        {
          do
          {
            v3 = ZwReplyWaitReceivePort(
                   PortHandle,
                   (INT64)&Silo,
                   (INT64)v2,
                   (INT64)&CommandMessage,
                   v21,
                   v22,
                   Silo.m256i_i64[0],
                   Silo.m256i_i64[1]);
            v2 = 0i64;
          }
          while( v3 < 0 && (v3 == -1073741823 || v3 == -1073741813 || v3 == -1073741281) );
          v7 = (_EJOB *)Silo.m256i_i64[0];
          if( Silo.m256i_i64[0] == -8 )
          {
            LODWORD(v8) = HalSystemVectorDispatchEntry(v5, v4, v6);
            v7 = (_EJOB *)v8;
            Silo.m256i_i64[0] = v8;
          }
          v9 = v28 & 0x7FFF;
          LOWORD(v28) = v9;
          if( v9 != 1 )
            break;
          if( (unsigned int)(*(_DWORD *)&v29[32] - 1) <= 0xB )
          {
            LODWORD(v10) = PsAttachSiloToCurrentThread((INT64)v7);
            v11 = v10;
            ((void(__fastcall *)(_RM_COMMAND_MESSAGE *, _RM_REPLY_MESSAGE *))SepRmCommandDispatch[*(int *)&v29[32]])(
              &CommandMessage,
              ReplyMessage);
            PsDetachSiloFromCurrentThread(v11);
            v2 = ReplyMessage;
            ReplyMessage[6] = *(_DWORD *)&v29[16];
            *(_OWORD *)&ReplyMessage[2] = *(_OWORD *)v29;
          }
        }
        if( v9 == 5 )
          break;
        if( v9 == 10 )
          SepRmLsaConnectRequest(&CommandMessage);
      }
      if( PsIsHostSilo(v7) )
      {
        SepRmAuditingEnabled = 0;
        v26 = 0i64;
        memset(v25, 0, sizeof(v25));
        memset(&Silo.m256i_u64[1], 0, 24);
        Object_8 = 0i64;
        KeInitializeEvent((INT64)&Silo.m256i_i64[1], 0, 0);
        KeInitializeEvent((INT64)&v25[1], 0, 0);
        KeInitializeEvent((INT64)&Object_8, 0, 0);
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --CurrentThread->Tcb.KernelApcDisable;
        ExAcquireResourceExclusiveLite((UINT64)&stru_140C543C0, 1, v13);
        qword_140C54460 = (__int64)&Silo.m256i_i64[1];
        v14 = *(_QWORD *)&SepLsaAuditQueueInfo == (_QWORD)&SepLsaAuditQueueInfo;
        ExReleaseResourceLite(&stru_140C543C0);
        KeLeaveCriticalRegion();
        inited = SepAdtInitLsaDeadEventForNonPagedList((_KEVENT *)&Object_8);
        v16 = (_ETHREAD *)KeGetCurrentThread();
        v17 = inited;
        --v16->Tcb.KernelApcDisable;
        ExAcquireResourceExclusiveLite((UINT64)&stru_140C54280, 1, v18);
        qword_140C54320 = (__int64)&v25[1];
        v19 = *(_QWORD *)&SepLsaDeletedLogonQueueInfo == (_QWORD)&SepLsaDeletedLogonQueueInfo;
        ExReleaseResourceLite(&stru_140C54280);
        KeLeaveCriticalRegion();
        if( !v14 )
          KeWaitForSingleObject((UINT64)&Silo.m256i_u64[1], 0, 0, 0, 0i64);
        if( v17 )
          KeWaitForSingleObject((UINT64)&Object_8, 0, 0, 0, 0i64);
        if( !v19 )
          KeWaitForSingleObject((UINT64)&v25[1], 0, 0, 0, 0i64);
        ZwClose(PortHandle);
        PortHandle = 0i64;
        v7 = (_EJOB *)Silo.m256i_i64[0];
      }
      ServerSiloGlobals = PsGetServerSiloGlobals(v7);
      SepRmCleanupRmLsaState(&ServerSiloGlobals->SeRmSiloState);
      if( PsIsHostSilo((_EJOB *)Silo.m256i_i64[0]) )
        break;
      ObfDereferenceObjectWithTag((VOID *)Silo.m256i_i64[0], 0x74536553ui64);
      Silo.m256i_i64[0] = (__int64)MmBadPointer;
    }
  }
}

Referenced by: