VrpPreUnloadKey

INT64 __fastcall VrpPreUnloadKey(INT64 a1, UINT64 *a2){
  _ETHREAD *CurrentThread; 
  __int64 v3; 
  volatile INT64 *v6; 
  UNICODE_STRING *ExactNamespaceNode; 
  unsigned int v8; 
  unsigned __int64 v10; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = *(_QWORD *)(a1 + 24);
  --*((_WORD *)CurrentThread + 242);
  v6 = (volatile INT64 *)(a2 + 2);
  ExAcquirePushLockExclusiveEx((UINT64)(a2 + 2), 0i64);
  ExactNamespaceNode = VrpFindExactNamespaceNode(a2, (unsigned __int16 *)(v3 + 16), &v10);
  v8 = 0;
  if( ExactNamespaceNode )
  {
    if( SLODWORD(ExactNamespaceNode[3].Buffer) < 0 )
    {
      *(_QWORD *)(a1 + 16) = ExactNamespaceNode;
    }
    else
    {
      v8 = -1073741790;
      if( (_InterlockedExchangeAdd64(v6, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v6);
      KeAbPostRelease((PVOID)v6);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    }
    return v8;
  }
  else
  {
    if( (_InterlockedExchangeAdd64(v6, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v6);
    KeAbPostRelease((PVOID)v6);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    return 0i64;
  }
}

Referenced by: