SepLogTokenSidManagement

void __fastcall SepLogTokenSidManagement(int a1, _SEP_SID_VALUES_BLOCK *a2, _SEP_SID_VALUES_BLOCK *a3, __int64 a4){
  int v6; 
  _LUID *v7; 
  _DWORD *v8; 
  __int64 v9; 
  int v10; 
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  void *v12; 
  void *v13; 
  int v14; 
  void *v15; 
  int v16; 
  __int64 ReferenceCount; 
  unsigned int SidCount; 
  unsigned int v19; 
  void *SidValuesDump; 
  __int64 v21; 
  __int64 v22; 
  unsigned int v23; 
  unsigned int v24; 
  __int64 v25; 
  ULONG v26; 
  void *v27; 
  VOID *v28; 
  unsigned int v29; 
  __int64 v30; 
  unsigned int v31; 
  int v32; 
  int v33; 
  int v34; 
  UINT64 OutputSize; 
  unsigned int v36; 
  unsigned int v37; 
  _LUID v38; 
  _LUID v39; 
  __int64 v40; 
  __int64 v41; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  void *v43; 
  int v44; 
  int v45; 
  void *v46; 
  int v47; 
  int v48; 
  void *v49; 
  int v50; 
  int v51; 
  _LUID *v52; 
  __int64 v53; 
  _LUID *v54; 
  __int64 v55; 
  int *v56; 
  __int64 v57; 
  int *v58; 
  __int64 v59; 
  int *v60; 
  __int64 v61; 
  __int64 *v62; 
  __int64 v63; 
  int *v64; 
  __int64 v65; 
  void *v66; 
  int v67; 
  int v68; 

  v6 = a1;
  v31 = 0;
  OutputSize = 0i64;
  if( *(&ExBootDevicesRemovedEvent + 380) && SepTokenSidManagementLoggingEnabled )
  {
    if( a4 )
    {
      v38 = RtlConvertLuidToUlonglong((_LUID *)(a4 + 16));
      v39 = RtlConvertLuidToUlonglong(v7 + 3);
      v32 = v8[48];
      v33 = v8[49];
      v34 = v8[50];
    }
    else
    {
      v38 = 0i64;
      v39 = 0i64;
      v32 = 0;
      v33 = 0;
      v34 = 0;
    }
    UserData.Ptr = (unsigned __int64)SepGetSidManagementActionName(v6, &v31);
    v10 = 2;
    UserData.Size = v31;
    UserData.Reserved = 0;
    ImageFileName = KeGetCurrentThread()->ApcState.Process->SeAuditProcessCreationInfo.ImageFileName;
    v12 = &unk_140CF9D90;
    if( ImageFileName && *(_WORD *)ImageFileName )
    {
      v13 = (void *)*((_QWORD *)ImageFileName + 1);
      v14 = *((unsigned __int16 *)ImageFileName + 1);
    }
    else
    {
      v13 = &unk_140CF9D90;
      v14 = 2;
    }
    v43 = v13;
    v44 = v14;
    v45 = 0;
    if( v9 && *(_WORD *)(v9 + 56) )
    {
      v15 = *(void **)(v9 + 64);
      v16 = *(unsigned __int16 *)(v9 + 58);
    }
    else
    {
      v15 = &unk_140CF9D90;
      v16 = 2;
    }
    v46 = v15;
    v47 = v16;
    v48 = 0;
    if( v9 && *(_WORD *)(v9 + 72) )
    {
      v12 = *(void **)(v9 + 80);
      v10 = *(unsigned __int16 *)(v9 + 74);
    }
    v49 = v12;
    v52 = &v38;
    v54 = &v39;
    v56 = &v32;
    v58 = &v33;
    v60 = &v34;
    v50 = v10;
    v51 = 0;
    v53 = 8i64;
    v55 = 8i64;
    v57 = 4i64;
    v59 = 4i64;
    v61 = 4i64;
    if( a2 )
      ReferenceCount = a2->ReferenceCount;
    else
      ReferenceCount = 0i64;
    v40 = ReferenceCount;
    v62 = &v40;
    v63 = 8i64;
    if( a2 )
      SidCount = a2->SidCount;
    else
      SidCount = 0;
    v36 = SidCount;
    v64 = (int *)&v36;
    v19 = 11;
    v65 = 4i64;
    SidValuesDump = 0i64;
    if( a2 && SidCount )
    {
      SidValuesDump = SepGetSidValuesDump(a2, &OutputSize);
      v67 = OutputSize;
      v19 = 12;
      v66 = SidValuesDump;
      v68 = 0;
    }
    if( a3 )
      v21 = a3->ReferenceCount;
    else
      v21 = 0i64;
    v41 = v21;
    v22 = v19;
    v23 = v19 + 1;
    v22 *= 2i64;
    *(&UserData.Ptr + v22) = (unsigned __int64)&v41;
    *((_QWORD *)&UserData.Size + v22) = 8i64;
    if( !a3 || a2 == a3 )
      v24 = 0;
    else
      v24 = a3->SidCount;
    v25 = 2i64 * v23;
    v37 = v24;
    v26 = v23 + 1;
    v27 = 0i64;
    *(&UserData.Ptr + v25) = (unsigned __int64)&v37;
    *((_QWORD *)&UserData.Size + v25) = 4i64;
    if( a3 && v24 )
    {
      v28 = SepGetSidValuesDump(a3, (UINT64 *)((char *)&OutputSize + 4));
      v29 = HIDWORD(OutputSize);
      v27 = v28;
      v30 = 2i64 * v26++;
      *(&UserData.Ptr + v30) = (unsigned __int64)v28;
      *(&UserData.Size + 2 * v30) = v29;
      *(&UserData.Reserved + 2 * v30) = 0;
    }
    EtwWrite(*(&ExBootDevicesRemovedEvent + 380), &TokenSidManagementLog, 0, v26, &UserData);
    if( SidValuesDump )
      ExFreePoolWithTag(SidValuesDump, 0);
    if( v27 )
      ExFreePoolWithTag(v27, 0);
  }
}

Referenced by: