SepAddTokenLogonSession

VOID __fastcall SepAddTokenLogonSession(INT64 a1){
  _ETHREAD *CurrentThread; 
  unsigned int v3; 
  __int64 v4; 
  struct _ERESOURCE *v5; 
  __int64 *v6; 
  __int64 *PoolWithTag; 
  __int64 *v8; 
  __int64 **v9; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = (unsigned int)(1529154084 * *(_DWORD *)(a1 + 24)) >> 28;
  --*((_WORD *)CurrentThread + 242);
  v4 = v3;
  v5 = &SepRmDbLock + (v3 & 3);
  ExAcquireResourceExclusiveLite(v5, 1u);
  v6 = *(__int64 **)(SepLogonSessions + 8 * v4);
  if( v6 )
  {
    while( *(_DWORD *)(a1 + 24) != *((_DWORD *)v6 + 2)
         || *(_DWORD *)(a1 + 28) != *((_DWORD *)v6 + 3)
         || *(_QWORD *)(*(_QWORD *)(a1 + 216) + 160i64) != v6[20] )
    {
      v6 = (__int64 *)*v6;
      if( !v6 )
        goto LABEL_11;
    }
    PoolWithTag = (__int64 *)ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x734C6553ui64);
    if( PoolWithTag )
    {
      *PoolWithTag = 0i64;
      v8 = v6 + 22;
      PoolWithTag[1] = 0i64;
      PoolWithTag[2] = a1;
      v9 = (__int64 **)v8[1];
      if( *v9 != v8 )
        __fastfail(3u);
      *PoolWithTag = (__int64)v8;
      PoolWithTag[1] = (__int64)v9;
      *v9 = PoolWithTag;
      v8[1] = (__int64)PoolWithTag;
    }
  }
LABEL_11:
  ExReleaseResourceLite(v5);
  KeLeaveCriticalRegion();
}

Referenced by: