SepDereferenceLowBoxNumberEntry

NTSTATUS __stdcall SepDereferenceLowBoxNumberEntry(UINT64 SessionId, PVOID P){
  unsigned int v2; 
  NTSTATUS TokenSessionMapEntry; 
  _ETHREAD *v5; 
  __int64 v6; 
  ULONG_PTR v8; 
  UINT8 v9; 
  void *v10; 
  _ETHREAD *CurrentThread; 
  ULONG_PTR BugCheckParameter2; 
  v2 = SessionId;
  BugCheckParameter2 = 0i64;
  TokenSessionMapEntry = 0;
  if( (unsigned int)SessionId >= 5 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockSharedEx((UINT64)&LowboxSessionMapLock, 0i64);
    TokenSessionMapEntry = SepGetTokenSessionMapEntry(v2, 0, (CHAR **)&BugCheckParameter2);
    if( _InterlockedCompareExchange64((volatile signed __int64 *)&LowboxSessionMapLock, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared((INT64 *)&LowboxSessionMapLock);
    KeAbPostRelease(&LowboxSessionMapLock);
    KeLeaveCriticalRegion();
  }
  else
  {
    BugCheckParameter2 = (ULONG_PTR)&g_SessionLowboxArray[5 * (unsigned int)SessionId];
  }
  v5 = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)v5 + 242);
  ExAcquirePushLockExclusiveEx(BugCheckParameter2, 0i64);
  v6 = _InterlockedDecrement64((volatile signed __int64 *)P + 3);
  if( v6 <= 0 )
  {
    if( v6 )
      __fastfail(0xEu);
    v8 = BugCheckParameter2;
    v9 = RtlRemoveEntryHashTable(
           *(RTL_DYNAMIC_HASH_TABLE **)(BugCheckParameter2 + 24),
           (RTL_DYNAMIC_HASH_TABLE_ENTRY *)P,
           0i64);
    if( v9 )
      _bittestandreset(*(signed __int32 **)(v8 + 16), *((_DWORD *)P + 10) - 1);
    else
      TokenSessionMapEntry = -1073741823;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
    KeAbPostRelease((PVOID)BugCheckParameter2);
    KeLeaveCriticalRegion();
    if( v9 )
    {
      v10 = (void *)*((_QWORD *)P + 6);
      if( v10 )
      {
        ExRemoveLowBoxAtomReferences(v10, *((unsigned int *)P + 10));
        RtlDereferenceAtomTable(*((PVOID *)P + 6));
        ExFreePoolWithTag(P, 0);
      }
    }
    return TokenSessionMapEntry;
  }
  else
  {
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
    KeAbPostRelease((PVOID)BugCheckParameter2);
    KeLeaveCriticalRegion();
    return 0;
  }
}

Referenced by: