VrpHandleIoctlUnloadDynamicallyLoadedHives

NTSTATUS __stdcall VrpHandleIoctlUnloadDynamicallyLoadedHives(
        VOID *Data,
        UINT64 DataLength,
        CHAR RequestorMode,
        _GUID *ActivityId,
        VOID *Object,
        UINT64 *SharedCacheMap){
  int JobSilo; 
  NTSTATUS PermanentSiloContext; 
  wchar_t *v8; 
  _SIZE_T v9; 
  wchar_t *v10; 
  UINT64 *v11; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  __int64 *v14; 
  __int64 v15; 
  UINT64 v17; 
  UINT64 Tag; 
  _SIZE_T Taga; 
  wchar_t *v20; 
  _SIZE_T v21; 
  wchar_t *v22; 
  _SIZE_T v23; 
  _OBJECT_ATTRIBUTES TargetKey; 
  _EJOB *Silo; 

  Object = 0i64;
  SharedCacheMap = 0i64;
  Silo = 0i64;
  if( (unsigned int)DataLength < 8 )
    return -1073741811;
  LODWORD(Tag) = 1381395779;
  JobSilo = ObReferenceObjectByHandleWithTag(
              *(VOID **)Data,
              6ui64,
              (_OBJECT_TYPE *)PsJobType,
              RequestorMode,
              Tag,
              &Object,
              0i64);
  if( JobSilo >= 0 )
  {
    JobSilo = PsGetJobSilo((_EJOB *)Object, &Silo);
    if( JobSilo >= 0 )
    {
      if( PsIsThreadInSilo((_ETHREAD *)KeGetCurrentThread(), Silo) )
      {
        JobSilo = -1073741811;
      }
      else
      {
        PermanentSiloContext = PsGetPermanentSiloContext(
                                 Silo,
                                 (unsigned int)VrpSiloContextSlot,
                                 (VOID **)&SharedCacheMap);
        JobSilo = PermanentSiloContext;
        if( PermanentSiloContext < 0 )
        {
          if( PermanentSiloContext == -1073741275 )
LABEL_15:
            JobSilo = 0;
        }
        else
        {
          v11 = SharedCacheMap;
          VrpLockJobContextExclusive(
            (PWCHAR)SharedCacheMap,
            v8,
            v9,
            v10,
            Taga,
            v20,
            v21,
            v22,
            v23,
            *(INT64 *)&TargetKey.Length,
            (PWCHAR)TargetKey.RootDirectory);
          if( !*((_DWORD *)v11 + 21) )
          {
            v12 = v11[6];
            v13 = 0i64;
            while( v13 < v12 )
            {
              v14 = 0i64;
              if( v13 < v12 )
              {
                if( !is_mul_ok(v11[5], v13)
                  || (v17 = v11[9], v14 = (__int64 *)(v17 + v11[5] * v13), (unsigned __int64)v14 < v17) )
                {
                  v14 = 0i64;
                }
              }
              v15 = *v14;
              if( *(int *)(*v14 + 56) < 0 )
              {
                *(&TargetKey.Length + 1) = 0;
                memset(&TargetKey.Attributes + 1, 0, 20);
                TargetKey.RootDirectory = 0i64;
                TargetKey.ObjectName = (_UNICODE_STRING *)(v15 + 24);
                TargetKey.Length = 48;
                TargetKey.Attributes = 576;
                ZwUnloadKey2(&TargetKey, 1ui64);
                VrpDestroyNamespaceNode(v11, v15);
                v12 = v11[6];
              }
              else
              {
                ++v13;
              }
            }
            VrpCleanupNamespace((__int64)v11);
            VrpUnlockJobContextExclusive((INT64)v11);
            goto LABEL_15;
          }
          JobSilo = -1073741738;
          VrpUnlockJobContextExclusive((INT64)v11);
        }
      }
    }
  }
  if( Object )
    ObfDereferenceObjectWithTag(Object, 0x52566D43ui64);
  return JobSilo;
}

Referenced by: