SepGetTokenSessionMapEntry

INT64 __fastcall SepGetTokenSessionMapEntry(INT64 a1, CHAR a2, CHAR **a3){
  __int64 **v4; 
  int v6; 
  __int64 *i; 
  CHAR *v9; 
  char *PoolWithTag; 
  __int64 v11; 
  __int64 v12; 
  *a3 = 0i64;
  v4 = (__int64 **)g_SessionLowboxMap;
  v6 = a1;
  if( g_SessionLowboxMap )
  {
LABEL_5:
    for( i = *v4; i != (__int64 *)v4; i = (__int64 *)*i )
    {
      if( *((_DWORD *)i + 4) == v6 )
      {
        v9 = (CHAR *)(i + 3);
LABEL_17:
        *a3 = v9;
        return 0i64;
      }
    }
    if( !a2 )
      return 3221226021i64;
    PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, 0x40ui64, 0x734C6553ui64);
    if( PoolWithTag )
    {
      v11 = g_SessionLowboxMap;
      v9 = PoolWithTag + 24;
      *((_QWORD *)PoolWithTag + 3) = 0i64;
      PoolWithTag[56] = 0;
      *((_DWORD *)PoolWithTag + 4) = v6;
      v12 = *(_QWORD *)v11;
      if( *(_QWORD *)(*(_QWORD *)v11 + 8i64) != v11 )
        __fastfail(3u);
      *(_QWORD *)PoolWithTag = v12;
      *((_QWORD *)PoolWithTag + 1) = v11;
      *(_QWORD *)(v12 + 8) = PoolWithTag;
      *(_QWORD *)v11 = PoolWithTag;
      goto LABEL_17;
    }
    return 3221225626i64;
  }
  if( !a2 )
    return 3221226021i64;
  v4 = (__int64 **)ExAllocatePoolWithTag(
                     (_POOL_TYPE)(g_SessionLowboxMap + 1),
                     (unsigned int)(g_SessionLowboxMap + 16),
                     0x734C6553ui64);
  g_SessionLowboxMap = (__int64)v4;
  if( v4 )
  {
    v4[1] = (__int64 *)v4;
    *v4 = (__int64 *)v4;
    goto LABEL_5;
  }
  return 3221225626i64;
}

Referenced by: