SepRemoveTokenLogonSession

VOID __stdcall SepRemoveTokenLogonSession(_TOKEN *Token){
  INT64 v1; 
  _ETHREAD *CurrentThread; 
  unsigned int v4; 
  __int64 v5; 
  _ERESOURCE *v6; 
  __int64 *v7; 
  _TOKEN **v8; 
  _TOKEN *v9; 
  void **v10; 

  if( (Token->TokenFlags & 0x20) == 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v4 = (1529154084 * Token->AuthenticationId.LowPart) >> 28;
    --CurrentThread->Tcb.KernelApcDisable;
    v5 = v4;
    v6 = &stru_140CEC5A0 + (v4 & 3);
    ExAcquireResourceExclusiveLite((UINT64)v6, 1, v1);
    v7 = *(__int64 **)(SepLogonSessions + 8 * v5);
    if( v7 )
    {
      while( 1 )
      {
        if( Token->AuthenticationId.LowPart == *((_DWORD *)v7 + 2)
          && Token->AuthenticationId.HighPart == *((_DWORD *)v7 + 3)
          && Token->LogonSession->ServerSilo == (_EJOB *)v7[20] )
        {
          v8 = (_TOKEN **)v7[22];
          if( v8 != (_TOKEN **)(v7 + 22) )
            break;
        }
LABEL_9:
        v7 = (__int64 *)*v7;
        if( !v7 )
          goto LABEL_10;
      }
      while( 1 )
      {
        v9 = *v8;
        if( v8[2] == Token )
          break;
        v8 = (_TOKEN **)*v8;
        if( v9 == (_TOKEN *)(v7 + 22) )
          goto LABEL_9;
      }
      if( (_TOKEN **)v9->TokenSource.SourceIdentifier != v8 || (v10 = (void **)v8[1], *v10 != v8) )
        __fastfail(3u);
      *v10 = v9;
      v9->TokenSource.SourceIdentifier = (_LUID)v10;
      ExReleaseResourceLite(v6);
      KeLeaveCriticalRegion();
      ExFreePoolWithTag(v8, 0);
    }
    else
    {
LABEL_10:
      ExReleaseResourceLite(v6);
      KeLeaveCriticalRegion();
    }
  }
}

Referenced by: