PsDeleteVsmEnclave

INT64 __fastcall PsDeleteVsmEnclave(INT64 a1, _QWORD *a2){
  volatile INT64 *v4; 
  __int64 v5; 
  _QWORD *i; 
  __int64 v8; 
  if( !*((_BYTE *)a2 + 76) )
  {
    v4 = (volatile INT64 *)(a1 + 2264);
    ExAcquirePushLockExclusiveEx(a1 + 2264, 0i64);
    v5 = *(_QWORD *)(a1 + 2248);
    v8 = a2[1] & (-1i64 << (*(_DWORD *)(v5 + 4) & 0x1F));
    for( i = (_QWORD *)(*(_QWORD *)(v5 + 8)
                       + 8i64
                       * ((37
                         * (BYTE6(v8)
                          + 37
                          * (BYTE5(v8)
                           + 37
                           * (BYTE4(v8)
                            + 37
                            * (BYTE3(v8) + 37 * (BYTE2(v8) + 37 * (BYTE1(v8) + 37 * ((unsigned __int8)v8 + 11623883)))))))
                         + HIBYTE(v8)) & (unsigned int)((*(_DWORD *)(v5 + 4) >> 5) - 1))); (*i & 1) == 0; i = (_QWORD *)*i )
    {
      if( (_QWORD *)*i == a2 )
      {
        *i = *a2;
        --*(_DWORD *)v5;
        *a2 |= 0x8000000000000002ui64;
        break;
      }
    }
    if( (_InterlockedExchangeAdd64(v4, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v4);
    KeAbPostRelease((PVOID)v4);
  }
  return PsDereferenceVsmEnclave(a2);
}

Referenced by: