VrpPostUnloadKey
NTSTATUS __stdcall VrpPostUnloadKey(INT64 a1, INT64 a2){
__int64 v4;
_LPGUID ActivityId[4];
*(_OWORD *)ActivityId = 0i64;
EtwActivityIdControl(3ui64, (_GUID *)ActivityId);
v4 = *(_QWORD *)(a1 + 32);
if( v4 )
{
if( *(int *)(a1 + 8) >= 0 )
VrpDestroyNamespaceNode((UINT64 *)a2, v4);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a2 + 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(a2 + 16));
KeAbPostRelease((VOID *)(a2 + 16));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
return 0;
}Referenced by:
VrpRegistryCallback