MiUnloadHotPatchForUserSid

NTSTATUS __stdcall MiUnloadHotPatchForUserSid(VOID *a1, INT64 *a2){
  _ETHREAD *CurrentThread; 
  INT64 *v3; 
  _RTL_BALANCED_NODE *UserSidHotPatchContext; 
  INT64 *v7; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 0i64;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx(&MiHotPatchListLock, 0i64);
  UserSidHotPatchContext = MiFindUserSidHotPatchContext((UINT8 *)a1);
  v7 = (INT64 *)UserSidHotPatchContext;
  if( UserSidHotPatchContext )
  {
    MiDeleteHotPatchRecord(UserSidHotPatchContext[1].Children, 1u, *(unsigned int *)a2, *((unsigned int *)a2 + 1));
    if( !v7[3] )
    {
      RtlAvlRemoveNode((UINT64 *)&MiUserSidPatchLists, v7);
      v3 = v7;
    }
  }
  if( (_InterlockedExchangeAdd64(&MiHotPatchListLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&MiHotPatchListLock);
  KeAbPostRelease(&MiHotPatchListLock);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  MiHotPatchAllProcesses(*(unsigned int *)a2, *((unsigned int *)a2 + 1));
  return 0;
}

Referenced by: