SeUnregisterLogonSessionTerminatedRoutine

NTSTATUS __fastcall SeUnregisterLogonSessionTerminatedRoutine(INT64 a1){
  NTSTATUS v1; 
  _ETHREAD *CurrentThread; 
  PVOID *v5; 
  PVOID *v6; 

  v1 = 0;
  if( !a1 )
    return -1073741811;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&stru_140CF2E80 + 5144));
  v5 = (PVOID *)SeFileSystemNotifyRoutinesHead;
  v6 = &SeFileSystemNotifyRoutinesHead;
  if( !SeFileSystemNotifyRoutinesHead )
    goto LABEL_8;
  do
  {
    if( v5[1] == (PVOID)a1 )
      break;
    v6 = v5;
    v5 = (PVOID *)*v5;
  }
  while( v5 );
  if( v5 )
  {
    *v6 = *v5;
    ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&stru_140CF2E80 + 5144));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    ExFreePoolWithTag(v5, 0);
  }
  else
  {
LABEL_8:
    ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&stru_140CF2E80 + 5144));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    return -1073741275;
  }
  return v1;
}

Referenced by: