CmpGlobalUnlockKeyForWrite

VOID __fastcall CmpGlobalUnlockKeyForWrite(UINT64 a1, PVOID P){
  signed __int64 v4; 
  signed __int64 i; 
  signed __int64 v6; 
  _ETHREAD *CurrentThread; 
  __int64 v8; 
  _QWORD *v9; 
  PVOID *v10; 
  _m_prefetchw((char *)P + 16);
  v4 = *((_QWORD *)P + 2);
  for( i = v4 - 1; i > 0; i = v4 - 1 )
  {
    v6 = v4;
    v4 = _InterlockedCompareExchange64((volatile signed __int64 *)P + 2, i, v4);
    if( v6 == v4 )
      return;
  }
  if( i )
    __fastfail(0xEu);
  CmpLockKcbExclusive(a1);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&CmpKeyLockTracker, 0i64);
  v8 = _InterlockedDecrement64((volatile signed __int64 *)P + 2);
  if( v8 > 0 )
  {
    ExReleasePushLockEx((UINT64)&CmpKeyLockTracker, 0i64);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    CmpUnlockKcb(a1);
  }
  else
  {
    if( v8 )
      __fastfail(0xEu);
    v9 = *(_QWORD **)P;
    if( *(PVOID *)(*(_QWORD *)P + 8i64) != P || (v10 = (PVOID *)*((_QWORD *)P + 1), *v10 != P) )
      __fastfail(3u);
    *v10 = v9;
    v9[1] = v10;
    ExReleasePushLockEx((UINT64)&CmpKeyLockTracker, 0i64);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    *(_WORD *)(a1 + 8) &= ~0x80u;
    CmpUnlockKcb(a1);
    CmpDereferenceKeyControlBlock(*((_QWORD *)P + 3));
    CmpFreeTransientPoolWithTag(P, 0x33374D43ui64);
  }
}

Referenced by: