PsRemoveCreateThreadNotifyRoutine

NTSTATUS __fastcall PsRemoveCreateThreadNotifyRoutine(INT64 a1){
  _ETHREAD *CurrentThread; 
  __int64 v3; 
  _EX_RUNDOWN_REF *v4; 
  _EX_RUNDOWN_REF *v5; 
  volatile signed __int32 *v7; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v3 = 0i64;
  while( 1 )
  {
    v4 = ExReferenceCallBackBlock((INT64 *)&stru_140CEBF20 + v3);
    v5 = v4;
    if( v4 )
      break;
LABEL_6:
    v3 = (unsigned int)(v3 + 1);
    if( (unsigned int)v3 >= 0x40 )
    {
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
      return -1073741702;
    }
  }
  if( v4[1].Count != a1 || !ExCompareExchangeCallBack(&stru_140CEBF20 + 2 * v3, 0i64, (_EX_CALLBACK_ROUTINE_BLOCK *)v4) )
  {
    ExDereferenceCallBackBlock(&stru_140CEBF20 + 2 * v3, v5);
    goto LABEL_6;
  }
  v7 = &PspCreateThreadNotifyRoutineNonSystemCount;
  if( !v5[2].Count )
    v7 = &PspCreateThreadNotifyRoutineCount;
  _InterlockedAdd(v7, 0xFFFFFFFF);
  ExDereferenceCallBackBlock(&stru_140CEBF20 + 2 * v3, v5);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  ExWaitForRundownProtectionRelease(v5);
  ExFreePoolWithTag(v5, 0);
  return 0;
}

Referenced by: