VrpHandleIoctlUnloadDifferencingHiveForHost

NTSTATUS __stdcall VrpHandleIoctlUnloadDifferencingHiveForHost(
        VOID *Data,
        UINT64 DataLength,
        CHAR RequestorMode,
        _GUID *ActivityId){
  _QWORD *v6; 
  NTSTATUS v7; 
  int v8; 
  unsigned int v9; 
  __int64 v10; 
  __int64 *v11; 
  __int64 v12; 
  NTSTATUS v13; 
  _UNICODE_STRING String1; 
  _UNICODE_STRING String2[2]; 

  *(_DWORD *)(&String2[0].MaximumLength + 1) = 0;
  v6 = 0i64;
  String1 = 0i64;
  if( (unsigned int)DataLength < 8 )
    return -1073741811;
  v8 = *((unsigned __int16 *)Data + 2);
  if( (v8 & 1) != 0 )
    return -1073741811;
  if( !(_WORD)v8 )
    return -1073741811;
  if( *(_DWORD *)Data )
    return -1073741811;
  v9 = v8 + 6;
  if( v9 < 6 || (unsigned int)DataLength < v9 )
    return -1073741811;
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeBackupPrivilege, RequestorMode)
    || !SeSinglePrivilegeCheck(*(_QWORD *)&SeRestorePrivilege, RequestorMode) )
  {
    return -1073741727;
  }
  String1.Buffer = (wchar_t *)((char *)Data + 6);
  String1.MaximumLength = *((_WORD *)Data + 2);
  String1.Length = String1.MaximumLength;
  ExAcquirePushLockExclusiveEx(&VrpHostLoadedHivesLock, 0i64);
  v10 = VrpHostLoadedHives;
  v11 = &VrpHostLoadedHives;
  if( VrpHostLoadedHives )
  {
    while( 1 )
    {
      v12 = *(_QWORD *)v10;
      String2[0].Buffer = (wchar_t *)(v10 + 10);
      String2[0].Length = *(_WORD *)(v10 + 8);
      String2[0].MaximumLength = String2[0].Length;
      if( (unsigned __int8)RtlEqualUnicodeString(&String1, String2, 1u) )
        break;
      v11 = (__int64 *)v10;
      v10 = v12;
      if( !v12 )
        goto LABEL_16;
    }
    *v11 = v12;
    v6 = (_QWORD *)v10;
    *(_QWORD *)v10 = 0i64;
  }
LABEL_16:
  if( (_InterlockedExchangeAdd64(&VrpHostLoadedHivesLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&VrpHostLoadedHivesLock);
  KeAbPostRelease(&VrpHostLoadedHivesLock);
  if( !v6 )
    return -1073741772;
  v13 = VrpUnloadDifferencingHive(&String1);
  if( v13 == -1073741772 )
    v13 = 0;
  v7 = v13;
  if( v13 >= 0 )
  {
    ExFreePoolWithTag(v6, 0);
    v6 = 0i64;
    v7 = 0;
  }
  if( v6 )
  {
    ExAcquirePushLockExclusiveEx(&VrpHostLoadedHivesLock, 0i64);
    *v6 = VrpHostLoadedHives;
    VrpHostLoadedHives = (__int64)v6;
    if( (_InterlockedExchangeAdd64(&VrpHostLoadedHivesLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&VrpHostLoadedHivesLock);
    KeAbPostRelease(&VrpHostLoadedHivesLock);
  }
  return v7;
}

Referenced by: