MiSessionRemoveImage

_RTL_BALANCED_NODE *__fastcall MiSessionRemoveImage(_KLDR_DATA_TABLE_ENTRY *BugCheckParameter2, INT64 a2){
  void *DllBase; 
  _EPROCESS *Process; 
  _MM_SESSION_SPACE *Session; 
  _MMSUPPORT_INSTANCE *SessionVm; 
  _MMSUPPORT_SHARED *SharedVm; 
  UINT8 v9; 
  UINT8 v10; 
  _RTL_BALANCED_NODE *v11; 
  _RTL_BALANCED_NODE *v12; 
  _RTL_BALANCED_NODE *v15; 
  _RTL_BALANCED_NODE *v16; 
  unsigned __int64 i; 
  _RTL_BALANCED_NODE *v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  unsigned __int64 k; 
  _QWORD *j; 
  unsigned __int64 v23; 
  UINT8 OldIrql; 

  DllBase = BugCheckParameter2->DllBase;
  OldIrql = 0;
  *(_OWORD *)a2 = 0i64;
  *(_QWORD *)(a2 + 16) = 0i64;
  Process = KeGetCurrentThread()->ApcState.Process;
  Session = Process->Session;
  SessionVm = MiGetSessionVm((INT64)BugCheckParameter2, a2, (INT16)Process);
  SharedVm = MiGetSharedVm(SessionVm);
  v9 = ExAcquireSpinLockExclusive((INT64 *)&SharedVm->WorkingSetLock);
  SharedVm->GoodCitizenWaiting = 0;
  v10 = v9;
  MmLockLoadedModuleListExclusive(&OldIrql);
  v11 = MiSessionLookupImage((UINT64)DllBase);
  v12 = v11;
  if( !v11 )
    KeBugCheckEx(0x1Au, (PVOID)0x2100, BugCheckParameter2, DllBase, 0i64);
  if( HIDWORD(v11[2].Right)-- == 1 )
  {
    v15 = v11->Children[0];
    v16 = v11;
    if( v11->Children[0] )
    {
      for( ; v15->Children[1]; v15 = v15->Children[1] )
        ;
    }
    else
    {
      for( i = v11->ParentValue; ; i = v15->ParentValue )
      {
        v15 = (_RTL_BALANCED_NODE *)(i & 0xFFFFFFFFFFFFFFFCui64);
        if( !v15 || v15->Children[1] == v16 )
          break;
        v16 = v15;
      }
    }
    if( v15 )
      v18 = v15[2].Children[0];
    else
      v18 = 0i64;
    v19 = (unsigned __int64)v12->Children[1];
    v20 = (unsigned __int64)v12;
    *(_QWORD *)a2 = v18;
    if( v19 )
    {
      for( j = *(_QWORD **)v19; j; j = (_QWORD *)*j )
        v19 = (unsigned __int64)j;
    }
    else
    {
      for( k = v12->ParentValue; ; k = *(_QWORD *)(v19 + 16) )
      {
        v19 = k & 0xFFFFFFFFFFFFFFFCui64;
        if( !v19 || *(_QWORD *)v19 == v20 )
          break;
        v20 = v19;
      }
    }
    if( v19 )
      v23 = *(_QWORD *)(v19 + 40) & 0xFFFFFFFFFFFFFFFCui64;
    else
      v23 = 0i64;
    *(_QWORD *)(a2 + 8) = v23;
    RtlAvlRemoveNode((UINT64 *)Session + 11, (INT64 *)v12);
    *(_QWORD *)(a2 + 16) = v12[3].Children[0];
  }
  else
  {
    v12 = 0i64;
  }
  ExReleaseSpinLockExclusiveFromDpcLevel(&PsLoadedModuleSpinLock);
  __writecr8(OldIrql);
  MiUnlockWorkingSetExclusive(SessionVm, v10);
  if( v12 && v12[2]._bf_0 == 1 )
    MiHandleDriverNonPagedSections(BugCheckParameter2, 0i64, 0i64);
  return v12;
}

Referenced by: