SepRemoveTokenLogonSession

VOID __fastcall SepRemoveTokenLogonSession(INT64 a1){
  _ETHREAD *CurrentThread; 
  unsigned int v3; 
  __int64 v4; 
  struct _ERESOURCE *v5; 
  __int64 *v6; 
  __int64 *v7; 
  __int64 *v8; 
  __int64 **v9; 
  if( (*(_DWORD *)(a1 + 200) & 0x20) == 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v3 = (unsigned int)(1529154084 * *(_DWORD *)(a1 + 24)) >> 28;
    --*((_WORD *)CurrentThread + 242);
    v4 = v3;
    v5 = &SepRmDbLock + (v3 & 3);
    ExAcquireResourceExclusiveLite(v5, 1u);
    v6 = *(__int64 **)(SepLogonSessions + 8 * v4);
    if( v6 )
    {
      while( 1 )
      {
        if( *(_DWORD *)(a1 + 24) == *((_DWORD *)v6 + 2)
          && *(_DWORD *)(a1 + 28) == *((_DWORD *)v6 + 3)
          && *(_QWORD *)(*(_QWORD *)(a1 + 216) + 160i64) == v6[20] )
        {
          v7 = (__int64 *)v6[22];
          if( v7 != v6 + 22 )
            break;
        }
LABEL_9:
        v6 = (__int64 *)*v6;
        if( !v6 )
          goto LABEL_10;
      }
      while( 1 )
      {
        v8 = (__int64 *)*v7;
        if( v7[2] == a1 )
          break;
        v7 = (__int64 *)*v7;
        if( v8 == v6 + 22 )
          goto LABEL_9;
      }
      if( (__int64 *)v8[1] != v7 || (v9 = (__int64 **)v7[1], *v9 != v7) )
        __fastfail(3u);
      *v9 = v8;
      v8[1] = (__int64)v9;
      ExReleaseResourceLite(v5);
      KeLeaveCriticalRegion();
      ExFreePoolWithTag(v7, 0);
    }
    else
    {
LABEL_10:
      ExReleaseResourceLite(v5);
      KeLeaveCriticalRegion();
    }
  }
}

Referenced by: