RawCheckForDeleteVolume
INT8 __stdcall RawCheckForDeleteVolume(PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader){
INT8 v1;
KIRQL v3;
_LIST_ENTRY *Flink;
_LIST_ENTRY *Blink;
v1 = 0;
if( !LODWORD(AdvancedHeader[1].Resource) )
{
v3 = KeAcquireQueuedSpinLock(9ui64);
if( *((_DWORD *)AdvancedHeader[1].FileContextSupportPointer + 7) )
{
KeReleaseQueuedSpinLock(9ui64, v3);
}
else
{
KeReleaseQueuedSpinLock(9ui64, v3);
Flink = AdvancedHeader[1].FilterContexts.Flink;
if( Flink->Blink != &AdvancedHeader[1].FilterContexts
|| (Blink = AdvancedHeader[1].FilterContexts.Blink, Blink->Flink != &AdvancedHeader[1].FilterContexts) )
{
__fastfail(3u);
}
Blink->Flink = Flink;
Flink->Blink = Blink;
KeReleaseGuardedMutex((_FAST_MUTEX *)&AdvancedHeader[2].PagingIoResource);
RawCleanupVcb(AdvancedHeader);
RawDeleteVcb((INT64)AdvancedHeader);
return 1;
}
}
return v1;
}Referenced by:
RawScanDeletedList