SepDeReferenceSharedSidEntries

VOID __stdcall SepDeReferenceSharedSidEntries(SID_AND_ATTRIBUTES *InputSids, UINT64 SidArrayCount){
  _ETHREAD *CurrentThread; 
  unsigned int v3; 
  __int64 v5; 
  PRTL_DYNAMIC_HASH_TABLE_ENTRY SharedSidEntry; 
  PRTL_DYNAMIC_HASH_TABLE_ENTRY v7; 
  __int64 v8; 
  volatile INT64 *v9; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = SidArrayCount;
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx(g_SepSidMapping, 0i64);
  if( v3 )
  {
    v5 = v3;
    do
    {
      SharedSidEntry = SepFindSharedSidEntry(InputSids->Sid);
      v7 = SharedSidEntry;
      v8 = _InterlockedDecrement64((volatile signed __int64 *)&SharedSidEntry[1]);
      if( v8 <= 0 )
      {
        if( v8 )
          __fastfail(0xEu);
        if( RtlRemoveEntryHashTable(*(RTL_DYNAMIC_HASH_TABLE **)(g_SepSidMapping + 8), SharedSidEntry, 0i64) )
          ExFreePoolWithTag(v7, 0);
      }
      ++InputSids;
      --v5;
    }
    while( v5 );
  }
  v9 = (volatile INT64 *)g_SepSidMapping;
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)g_SepSidMapping, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v9);
  KeAbPostRelease((PVOID)v9);
  KeLeaveCriticalRegion();
}

Referenced by:

SepFreeTokenCapabilities