IoAcquireRemoveLockEx

NTSTATUS __stdcall IoAcquireRemoveLockEx(
        PIO_REMOVE_LOCK RemoveLock,
        PVOID Tag,
        PCSTR File,
        UINT32 Line,
        UINT32 RemlockSize){
  NTSTATUS v9; 
  _LIST_ENTRY *PoolWithTag; 
  UINT64 v12; 
  _LIST_ENTRY *v13; 
  unsigned __int8 v14; 
  unsigned __int64 v15; 
  _InterlockedIncrement(&RemoveLock->Common.IoCount);
  v9 = 0;
  if( RemoveLock->Common.Removed )
  {
    if( _InterlockedExchangeAdd(&RemoveLock->Common.IoCount, 0xFFFFFFFF) == 1 )
      KeSetEvent(&RemoveLock->Common.RemoveEvent, 0);
    return -1073741738;
  }
  else if( RemlockSize == 120 )
  {
    PoolWithTag = (_LIST_ENTRY *)ExAllocatePoolWithTag(
                                   NonPagedPoolNx,
                                   0x28ui64,
                                   LODWORD(RemoveLock[1].Common.RemoveEvent.Header.WaitListHead.Flink));
    v13 = PoolWithTag;
    if( PoolWithTag )
    {
      PoolWithTag->Flink = 0i64;
      PoolWithTag[1].Flink = 0i64;
      HIDWORD(PoolWithTag[2].Flink) = 0;
      PoolWithTag->Blink = (_LIST_ENTRY *)Tag;
      PoolWithTag[1].Blink = (_LIST_ENTRY *)File;
      LODWORD(PoolWithTag[2].Flink) = Line;
      PoolWithTag[1].Flink = (_LIST_ENTRY *)KUSER_SHARED_DATA.TickCountQuad;
      KeAcquireSpinLockRaiseToDpc((UINT64 *)&RemoveLock[2].Common.RemoveEvent, v12);
      v15 = v14;
      v13->Flink = RemoveLock[3].Common.RemoveEvent.Header.WaitListHead.Flink;
      RemoveLock[3].Common.RemoveEvent.Header.WaitListHead.Flink = v13;
      KxReleaseSpinLock((UINT64 *)&RemoveLock[2].Common.RemoveEvent);
      __writecr8(v15);
    }
    else
    {
      _InterlockedIncrement((volatile signed __int32 *)&RemoveLock[2].Common.RemoveEvent.Header.WaitListHead);
    }
  }
  return v9;
}

Referenced by: