VrpPreUnloadKey

NTSTATUS __stdcall VrpPreUnloadKey(INT64 a1, UINT64 *a2){
  _ETHREAD *CurrentThread; 
  _UNICODE_STRING *v3; 
  _EX_PUSH_LOCK *v6; 
  _UNICODE_STRING *ExactNamespaceNode; 
  NTSTATUS v8; 
  UINT64 v10; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = *(_UNICODE_STRING **)(a1 + 24);
  --CurrentThread->Tcb.KernelApcDisable;
  v6 = (_EX_PUSH_LOCK *)(a2 + 2);
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)a2 + 2, 0i64);
  ExactNamespaceNode = VrpFindExactNamespaceNode(a2, v3 + 1, &v10);
  v8 = 0;
  if( ExactNamespaceNode )
  {
    if( SLODWORD(ExactNamespaceNode[3].Buffer) < 0 )
    {
      *(_QWORD *)(a1 + 16) = ExactNamespaceNode;
    }
    else
    {
      v8 = -1073741790;
      if( (_InterlockedExchangeAdd64(&v6->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v6);
      KeAbPostRelease(v6);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
    }
    return v8;
  }
  else
  {
    if( (_InterlockedExchangeAdd64(&v6->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v6);
    KeAbPostRelease(v6);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    return 0;
  }
}

Referenced by: