MiDeleteImageHotPatchState

VOID __stdcall MiDeleteImageHotPatchState(UINT64 a1){
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *ProcessHotPatchContext; 
  _EX_PUSH_LOCK *v4; 
  void *v5; 
  _EX_PUSH_LOCK *v6; 
  UINT64 bf_0; 
  int v8; 
  NTSTATUS v9; 
  UINT64 v10; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  ProcessHotPatchContext = (_EX_PUSH_LOCK *)MiGetProcessHotPatchContext((__int64)CurrentThread->Tcb.ApcState.Process, 0);
  v4 = ProcessHotPatchContext;
  if( ProcessHotPatchContext )
  {
    v5 = 0i64;
    --CurrentThread->Tcb.SpecialApcDisable;
    v6 = ProcessHotPatchContext + 2;
    ExAcquirePushLockExclusiveEx(ProcessHotPatchContext + 2, 0i64);
    bf_0 = v4->_bf_0;
    if( (v4[1]._bf_0 & 1) != 0 )
    {
      if( bf_0 )
        bf_0 ^= (unsigned __int64)v4;
      else
        bf_0 = 0i64;
    }
    v8 = v4[1]._bf_0 & 1;
    if( bf_0 )
    {
      do
      {
        v9 = MiHotPatchImageTreeCompare(a1, bf_0);
        if( v9 >= 0 )
        {
          if( v9 <= 0 )
            break;
          v10 = *(_QWORD *)(bf_0 + 8);
        }
        else
        {
          v10 = *(_QWORD *)bf_0;
        }
        if( v8 && v10 )
          bf_0 ^= v10;
        else
          bf_0 = v10;
      }
      while( bf_0 );
      v6 = v4 + 2;
      if( bf_0 )
      {
        RtlRbRemoveNode((UINT64 *)v4, bf_0);
        *(_DWORD *)(bf_0 + 92) |= 2u;
        v5 = (void *)bf_0;
        if( (*(_DWORD *)(bf_0 + 92) & 1) != 0 )
          v5 = 0i64;
      }
    }
    if( (_InterlockedExchangeAdd64(&v6->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v6);
    KeAbPostRelease(v6);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    if( v5 )
      MiDeleteHotPatchEntry(v5);
  }
}

Referenced by: