ExpEnumerateCallback

__int64 __fastcall ExpEnumerateCallback(__int64 a1, _QWORD *a2){
  UINT64 *v2; 
  unsigned __int8 v5; 
  __int64 **v6; 
  unsigned __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 *i; 

  v2 = (UINT64 *)(a1 + 8);
  v5 = KeAcquireSpinLockRaiseToDpc((UINT64 *)(a1 + 8));
  v6 = (__int64 **)(a1 + 16);
  v7 = v5;
  v8 = 0i64;
  v9 = *a2 & -(__int64)(*a2 != 0i64);
  if( *a2 )
    v6 = (__int64 **)*a2;
  v10 = a1 + 16;
  for( i = *v6; i != (__int64 *)v10; i = (__int64 *)*i )
  {
    if( !*((_BYTE *)i + 44) )
    {
      ++*((_DWORD *)i + 10);
      v8 = i[3];
      *a2 = i;
      break;
    }
  }
  if( v9 )
  {
    --*(_DWORD *)(v9 + 40);
    if( *(_BYTE *)(v9 + 44) )
    {
      if( !*(_DWORD *)(v9 + 40) )
        KeSetEvent((PRKEVENT)((char *)&ExBootDevicesRemovedEvent + 64), 0, 0);
    }
  }
  KxReleaseSpinLock(v2);
  __writecr8(v7);
  return v8;
}

Referenced by: