MiPrepareVadDelete

INT64 __fastcall MiPrepareVadDelete(INT64 a1, CHAR *a2, INT64 a3, INT64 a4, INT64 *a5){
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  __int64 v9; 
  unsigned __int64 v10; 
  int v11; 
  CHAR v12; 
  int v14; 
  _ETHREAD *v15; 
  int v16; 
  unsigned int v17; 
  _ETHREAD *CurrentThread; 
  v7 = *(unsigned int *)(a1 + 24) | ((unsigned __int64)*(unsigned __int8 *)(a1 + 32) << 32);
  v8 = (unsigned __int64)*(unsigned __int8 *)(a1 + 33) << 32;
  v9 = *(unsigned int *)(a1 + 28);
  *(_DWORD *)a5 = 0;
  v10 = v9 | v8;
  if( a3 != v7 || (v11 = 0, a4 != v10) )
  {
    v14 = *(_DWORD *)(a1 + 48);
    if( (v14 & 0x300000) != 3145728 )
    {
      if( (v14 & 0x70) != 0 )
      {
        if( (v14 & 0x70) == 64 )
          goto LABEL_12;
      }
      else if( (v14 & 0x100000) == 0 || (v14 & 0x400000) == 0 && (v14 & 0xC0000u) < 0x80000 )
      {
LABEL_12:
        if( a3 == v7 )
        {
          *(_DWORD *)a5 = 1;
          v11 = 1;
        }
        else
        {
          v11 = 2;
          if( a4 != v10 )
            v11 = 3;
          *(_DWORD *)a5 = v11;
        }
        goto LABEL_3;
      }
    }
    return 3221225631i64;
  }
LABEL_3:
  v12 = *a2;
  if( !v11 )
  {
    if( v12 == 1 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, *((_QWORD *)CurrentThread + 23));
      *a2 = 0;
    }
    return 0i64;
  }
  if( v12 )
    return 0i64;
  v15 = (_ETHREAD *)KeGetCurrentThread();
  *(_DWORD *)a5 = 0;
  *a2 = 1;
  MiLockAddressSpaceToo(*((_QWORD *)v15 + 23), a1);
  v16 = MiVadDeleted(a1);
  v17 = -1073741267;
  if( v16 == 1 )
    return(unsigned int)-1073741664;
  return v17;
}

Referenced by: