SepGetLogonSessionAccountInfo

INT64 __fastcall SepGetLogonSessionAccountInfo(
        _LUID *LogonId,
        _UNICODE_STRING *AccountName,
        _UNICODE_STRING *AuthorityName,
        VOID **Sid){
  _ETHREAD *CurrentThread; 
  _UNICODE_STRING *v7; 
  int v9; 
  unsigned int v10; 
  __int64 v11; 
  struct _ERESOURCE *v12; 
  __int64 *v13; 
  void *v14; 
  __int64 v15; 
  wchar_t *v17; 
  wchar_t *PoolWithTag; 
  VOID *v19; 
  wchar_t *Buffer; 
  wchar_t *v21; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v7 = AccountName;
  v9 = 0;
  v10 = (1529154084 * LogonId->LowPart) >> 28;
  --*((_WORD *)CurrentThread + 242);
  LOBYTE(AccountName) = 1;
  v11 = v10;
  v12 = &SepRmDbLock + (v10 & 3);
  ExAcquireResourceSharedLite(v12, (BOOL)AccountName);
  v13 = *(__int64 **)(SepLogonSessions + 8 * v11);
  if( v13 )
  {
    while( LogonId->LowPart != *((_DWORD *)v13 + 2) || LogonId->HighPart != *((_DWORD *)v13 + 3) )
    {
      v13 = (__int64 *)*v13;
      if( !v13 )
        goto LABEL_15;
    }
    v14 = 0i64;
    *v7 = *(_UNICODE_STRING *)(v13 + 7);
    *AuthorityName = *(_UNICODE_STRING *)(v13 + 9);
    v7->Buffer = 0i64;
    AuthorityName->Buffer = 0i64;
    if( !v13[8]
      || (v17 = (wchar_t *)ExAllocatePoolWithTag(PagedPool, *((unsigned __int16 *)v13 + 29), 0x6B416553ui64),
          (v7->Buffer = v17) != 0i64) )
    {
      if( v13[10] )
      {
        PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, *((unsigned __int16 *)v13 + 37), 0x6B416553ui64);
        AuthorityName->Buffer = PoolWithTag;
        if( !PoolWithTag )
          v9 = -1073741670;
      }
    }
    else
    {
      v9 = -1073741670;
    }
    v15 = v13[6];
    if( v9 < 0 )
      goto LABEL_24;
    if( Sid )
    {
      if( v15 )
      {
        v19 = ExAllocatePoolWithTag(
                PagedPool,
                4i64 * *(unsigned __int8 *)(**(_QWORD **)(v15 + 152) + 1i64) + 8,
                0x69536553ui64);
        v14 = v19;
        if( !v19 )
          v9 = -1073741670;
      }
    }
    if( v9 < 0 )
    {
LABEL_24:
      Buffer = v7->Buffer;
      if( Buffer )
        ExFreePoolWithTag(Buffer, 0);
      v21 = AuthorityName->Buffer;
      if( v21 )
        ExFreePoolWithTag(v21, 0);
      if( v14 )
        ExFreePoolWithTag(v14, 0);
    }
    else
    {
      memmove((UINT8 *)v7->Buffer, (UINT8 *)v13[8], *((unsigned __int16 *)v13 + 29));
      memmove((UINT8 *)AuthorityName->Buffer, (UINT8 *)v13[10], *((unsigned __int16 *)v13 + 37));
      if( v14 )
      {
        memmove(
          (UINT8 *)v14,
          **(UINT8 ***)(v15 + 152),
          4i64 * *(unsigned __int8 *)(**(_QWORD **)(v15 + 152) + 1i64) + 8);
        *Sid = v14;
      }
    }
  }
  else
  {
LABEL_15:
    v9 = -1073741729;
  }
  ExReleaseResourceLite(v12);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return(unsigned int)v9;
}

Referenced by: