SepQueueWorkItem
CHAR __fastcall SepQueueWorkItem(INT64 a1, INT64 a2, BYTE *a3){
CHAR v6;
char v7;
_BYTE *v8;
unsigned __int8 CurrentIrql;
_ETHREAD *CurrentThread;
__int64 v11;
__int64(__fastcall *v12)(INT64);
INT64 *v13;
INT64 *v15;
struct _KLOCK_QUEUE_HANDLE LockHandle;
memset(&LockHandle, 0, sizeof(LockHandle));
v6 = 0;
v7 = 0;
if( (unsigned int)PsGetServerSiloState(*(_QWORD *)(a2 + 56)) == 1 )
{
if( v8 )
*v8 = 0;
CurrentIrql = KeGetCurrentIrql();
if( CurrentIrql == 2 )
{
KeAcquireInStackQueuedSpinLock((UINT64 *)(a1 + 136), &LockHandle);
v11 = *(_QWORD *)(a1 + 200);
}
else
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquireResourceExclusiveLite((ERESOURCE *)(a1 + 32), 1u);
v11 = *(_QWORD *)(a1 + 192);
}
if( v11 )
{
if( a3 )
*a3 = 1;
goto LABEL_15;
}
v12 = *(__int64(__fastcall **)(INT64))(a1 + 208);
if( v12 )
v6 = v12(a2);
else
v6 = 1;
if( !v6 )
{
LABEL_15:
if( CurrentIrql == 2 )
{
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
__writecr8(LockHandle.OldIrql);
}
else
{
ExReleaseResourceLite((PERESOURCE)(a1 + 32));
KeLeaveCriticalRegion();
}
if( v7 )
{
*(_QWORD *)(a1 + 144) = 0i64;
*(_QWORD *)(a1 + 160) = SepRmCallLsa;
*(_QWORD *)(a1 + 168) = a1;
ExQueueWorkItem((WORK_QUEUE_ITEM *)(a1 + 144), DelayedWorkQueue);
}
return v6;
}
*(_DWORD *)(a2 + 52) = _InterlockedIncrement((volatile signed __int32 *)(a1 + 180));
if( CurrentIrql == 2 )
{
v15 = *(INT64 **)(a1 + 24);
if( *v15 == a1 + 16 )
{
*(_QWORD *)a2 = a1 + 16;
*(_QWORD *)(a2 + 8) = v15;
*v15 = a2;
*(_QWORD *)(a1 + 24) = a2;
LABEL_13:
if( _InterlockedIncrement((volatile signed __int32 *)(a1 + 176)) == 1 )
v7 = 1;
goto LABEL_15;
}
}
else
{
v13 = *(INT64 **)(a1 + 8);
if( *v13 == a1 )
{
*(_QWORD *)a2 = a1;
*(_QWORD *)(a2 + 8) = v13;
*v13 = a2;
*(_QWORD *)(a1 + 8) = a2;
goto LABEL_13;
}
}
__fastfail(3u);
}
if( a3 )
*v8 = 1;
return 0;
}Referenced by:
SepAdtLogAuditRecord
SepInformLsaOfDeletedLogon