SepInformLsaOfDeletedLogon
VOID __stdcall SepInformLsaOfDeletedLogon(_LUID *LogonId, VOID *ServerSilo, _SEP_LSA_WORK_ITEM *WorkItem){
_QWORD *PoolWithTag;
_LUID v6;
PoolWithTag = WorkItem;
if( !WorkItem )
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x40ui64, 2001495379i64);
if( PoolWithTag )
{
v6 = *LogonId;
PoolWithTag[5] = 0i64;
*((_DWORD *)PoolWithTag + 12) = 0;
*((_DWORD *)PoolWithTag + 5) = 0;
PoolWithTag[3] = v6;
*((_DWORD *)PoolWithTag + 8) = 3;
*((_DWORD *)PoolWithTag + 9) = 8;
*((_DWORD *)PoolWithTag + 4) = 1;
PoolWithTag[7] = ServerSilo;
if( !SepQueueWorkItem(&SepLsaDeletedLogonQueueInfo, (_SEP_LSA_WORK_ITEM *)PoolWithTag, 0i64) )
{
if( ServerSilo )
ObfDereferenceObjectWithTag(ServerSilo, 0x734C6553ui64);
ExFreePoolWithTag(PoolWithTag, 0);
}
}
else if( ServerSilo )
{
ObfDereferenceObjectWithTag(ServerSilo, 0x734C6553ui64);
}
}Referenced by:
SepDeReferenceLogonSession