SeRegisterLogonSessionTerminatedRoutineEx

__int64 __fastcall SeRegisterLogonSessionTerminatedRoutineEx(__int64 a1, __int64 a2){
  _QWORD *PoolWithTag; 
  _ETHREAD *CurrentThread; 
  if( !a1 )
    return 3221225485i64;
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x53466553ui64);
  if( !PoolWithTag )
    return 3221225626i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquireFastMutexUnsafe(&SepRmNotifyMutex);
  *PoolWithTag = SeFileSystemNotifyRoutinesExHead;
  PoolWithTag[1] = a1;
  PoolWithTag[2] = a2;
  SeFileSystemNotifyRoutinesExHead = PoolWithTag;
  ExReleaseFastMutexUnsafe(&SepRmNotifyMutex);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return 0i64;
}

Referenced by: