SepQueueWorkItem

CHAR __fastcall SepQueueWorkItem(INT64 a1, INT64 a2, BYTE *a3){
  CHAR v6; 
  char v7; 
  _BYTE *v8; 
  unsigned __int8 CurrentIrql; 
  _ETHREAD *CurrentThread; 
  __int64 v11; 
  __int64(__fastcall *v12)(INT64); 
  INT64 *v13; 
  INT64 *v15; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  memset(&LockHandle, 0, sizeof(LockHandle));
  v6 = 0;
  v7 = 0;
  if( (unsigned int)PsGetServerSiloState(*(_QWORD *)(a2 + 56)) == 1 )
  {
    if( v8 )
      *v8 = 0;
    CurrentIrql = KeGetCurrentIrql();
    if( CurrentIrql == 2 )
    {
      KeAcquireInStackQueuedSpinLock((UINT64 *)(a1 + 136), &LockHandle);
      v11 = *(_QWORD *)(a1 + 200);
    }
    else
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquireResourceExclusiveLite((ERESOURCE *)(a1 + 32), 1u);
      v11 = *(_QWORD *)(a1 + 192);
    }
    if( v11 )
    {
      if( a3 )
        *a3 = 1;
      goto LABEL_15;
    }
    v12 = *(__int64(__fastcall **)(INT64))(a1 + 208);
    if( v12 )
      v6 = v12(a2);
    else
      v6 = 1;
    if( !v6 )
    {
LABEL_15:
      if( CurrentIrql == 2 )
      {
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
        __writecr8(LockHandle.OldIrql);
      }
      else
      {
        ExReleaseResourceLite((PERESOURCE)(a1 + 32));
        KeLeaveCriticalRegion();
      }
      if( v7 )
      {
        *(_QWORD *)(a1 + 144) = 0i64;
        *(_QWORD *)(a1 + 160) = SepRmCallLsa;
        *(_QWORD *)(a1 + 168) = a1;
        ExQueueWorkItem((WORK_QUEUE_ITEM *)(a1 + 144), DelayedWorkQueue);
      }
      return v6;
    }
    *(_DWORD *)(a2 + 52) = _InterlockedIncrement((volatile signed __int32 *)(a1 + 180));
    if( CurrentIrql == 2 )
    {
      v15 = *(INT64 **)(a1 + 24);
      if( *v15 == a1 + 16 )
      {
        *(_QWORD *)a2 = a1 + 16;
        *(_QWORD *)(a2 + 8) = v15;
        *v15 = a2;
        *(_QWORD *)(a1 + 24) = a2;
LABEL_13:
        if( _InterlockedIncrement((volatile signed __int32 *)(a1 + 176)) == 1 )
          v7 = 1;
        goto LABEL_15;
      }
    }
    else
    {
      v13 = *(INT64 **)(a1 + 8);
      if( *v13 == a1 )
      {
        *(_QWORD *)a2 = a1;
        *(_QWORD *)(a2 + 8) = v13;
        *v13 = a2;
        *(_QWORD *)(a1 + 8) = a2;
        goto LABEL_13;
      }
    }
    __fastfail(3u);
  }
  if( a3 )
    *v8 = 1;
  return 0;
}

Referenced by:

SepAdtLogAuditRecord
SepInformLsaOfDeletedLogon