SepDeReferenceSharedSidEntries
VOID __stdcall SepDeReferenceSharedSidEntries(SID_AND_ATTRIBUTES *InputSids, UINT64 SidArrayCount){
_ETHREAD *CurrentThread;
unsigned int v3;
__int64 v5;
PRTL_DYNAMIC_HASH_TABLE_ENTRY SharedSidEntry;
PRTL_DYNAMIC_HASH_TABLE_ENTRY v7;
__int64 v8;
volatile INT64 *v9;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = SidArrayCount;
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx(g_SepSidMapping, 0i64);
if( v3 )
{
v5 = v3;
do
{
SharedSidEntry = SepFindSharedSidEntry(InputSids->Sid);
v7 = SharedSidEntry;
v8 = _InterlockedDecrement64((volatile signed __int64 *)&SharedSidEntry[1]);
if( v8 <= 0 )
{
if( v8 )
__fastfail(0xEu);
if( RtlRemoveEntryHashTable(*(RTL_DYNAMIC_HASH_TABLE **)(g_SepSidMapping + 8), SharedSidEntry, 0i64) )
ExFreePoolWithTag(v7, 0);
}
++InputSids;
--v5;
}
while( v5 );
}
v9 = (volatile INT64 *)g_SepSidMapping;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)g_SepSidMapping, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v9);
KeAbPostRelease((PVOID)v9);
KeLeaveCriticalRegion();
}Referenced by:
SepFreeTokenCapabilities