SepUpdateLogonSessionTrack

INT64 __fastcall SepUpdateLogonSessionTrack(INT64 a1){
  unsigned int v1; 
  _ETHREAD *CurrentThread; 
  unsigned int v4; 
  __int64 v5; 
  struct _ERESOURCE *v6; 
  __int64 *v7; 
  void *v8; 
  UINT8 *PoolWithTag; 
  unsigned __int64 v10; 
  unsigned __int64 v11; 
  v1 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = (unsigned int)(1529154084 * *(_DWORD *)a1) >> 28;
  --*((_WORD *)CurrentThread + 242);
  v5 = v4;
  v6 = &SepRmDbLock + (v4 & 3);
  ExAcquireResourceExclusiveLite(v6, 1u);
  v7 = *(__int64 **)(SepLogonSessions + 8 * v5);
  if( v7 )
  {
    while( *(_DWORD *)a1 != *((_DWORD *)v7 + 2) || *(_DWORD *)(a1 + 4) != *((_DWORD *)v7 + 3) )
    {
      v7 = (__int64 *)*v7;
      if( !v7 )
        goto LABEL_10;
    }
    v8 = (void *)v7[8];
    if( v8 )
    {
      ExFreePoolWithTag(v8, 0);
      v7[8] = 0i64;
      v7[10] = 0i64;
    }
    PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(
                             PagedPool,
                             *(unsigned __int16 *)(a1 + 24)
                           + 2i64
                           + ((*(unsigned __int16 *)(a1 + 8) + 9i64) & 0xFFFFFFF8i64),
                             0x734C6553ui64);
    if( PoolWithTag )
    {
      v7[8] = (__int64)PoolWithTag;
      v7[10] = (__int64)&PoolWithTag[(*(unsigned __int16 *)(a1 + 8) + 9i64) & 0xFFFFFFFFFFFFFFF8ui64];
      memmove(PoolWithTag, (UINT8 *)(a1 + 40), *(unsigned __int16 *)(a1 + 8));
      v10 = *(unsigned __int16 *)(a1 + 8);
      *((_WORD *)v7 + 28) = v10;
      *((_WORD *)v7 + 29) = v10 + 2;
      *(_WORD *)(v7[8] + 2 * (v10 >> 1)) = 0;
      memmove(
        (UINT8 *)v7[10],
        (UINT8 *)(((*(unsigned __int16 *)(a1 + 8) + 7i64) & 0xFFFFFFFFFFFFFFF8ui64) + a1 + 40),
        *(unsigned __int16 *)(a1 + 24));
      v11 = *(unsigned __int16 *)(a1 + 24);
      *((_WORD *)v7 + 36) = v11;
      *((_WORD *)v7 + 37) = v11 + 2;
      *(_WORD *)(v7[10] + 2 * (v11 >> 1)) = 0;
    }
    else
    {
      v1 = -1073741670;
    }
  }
  else
  {
LABEL_10:
    v1 = -1073741729;
  }
  ExReleaseResourceLite(v6);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return v1;
}

Referenced by: