NtShutdownWorkerFactory

NTSTATUS __stdcall NtShutdownWorkerFactory(PVOID WorkerFactoryHandle, INT64 *PendingWorkerCount){
  KPROCESSOR_MODE v3; 
  int v4; 
  PVOID v5; 
  _DWORD *v6; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  PVOID Object; 
  memset(&LockHandle, 0, sizeof(LockHandle));
  v3 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v3 )
  {
    if( ((unsigned __int8)PendingWorkerCount & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)PendingWorkerCount + 4 > 0x7FFFFFFF0000i64
      || (INT64 *)((char *)PendingWorkerCount + 4) < PendingWorkerCount )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  Object = 0i64;
  v4 = ObReferenceObjectByHandle(WorkerFactoryHandle, 0x20u, ExpWorkerFactoryObjectType, v3, &Object, 0i64);
  if( v4 >= 0 )
  {
    v5 = Object;
    ExpShutdownWorkerFactory((CHAR *)Object);
    ExWaitForRundownProtectionRelease((EX_RUNDOWN_REF *)v5 + 13);
    _InterlockedExchangeAdd((volatile signed __int32 *)PendingWorkerCount, *((_DWORD *)v5 + 74));
    v6 = Object;
    KeAcquireInStackQueuedSpinLock(*((UINT64 **)Object + 2), &LockHandle);
    v6[74] = 0;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
  }
  return v4;
}

Referenced by: