MiUnloadApproved

NTSTATUS __stdcall MiUnloadApproved(_KLDR_DATA_TABLE_ENTRY *DataTableEntry){
  void *DllBase; 
  unsigned __int16 LoadCount; 
  _RTL_BALANCED_NODE *v5; 
  _RTL_BALANCED_NODE *v6; 
  int Right_high; 
  int(*ExportedRoutineByName)(void); 
  _MM_SESSION_SPACE *Session; 

  DllBase = DataTableEntry->DllBase;
  if( MiGetSystemRegionType((UINT64)DllBase) == 1 )
  {
    v5 = MiSessionLookupImage((UINT64)DllBase);
    v6 = v5;
    if( !v5 )
    {
      Session = KeGetCurrentThread()->ApcState.Process->Session;
      if( (*((_DWORD *)Session + 1) & 2) == 0 )
        KeBugCheckEx(0x1Au, (PVOID)0x2200, DataTableEntry, DllBase, (PVOID)*((unsigned int *)Session + 2));
      return 0;
    }
    Right_high = HIDWORD(v5[2].Right);
    if( Right_high != 1 )
    {
      HIDWORD(v6[2].Right) = Right_high - 1;
      return 0;
    }
  }
  else
  {
    LoadCount = DataTableEntry->LoadCount;
    if( LoadCount != 1 )
    {
      DataTableEntry->LoadCount = LoadCount - 1;
      return 0;
    }
  }
  if( (HIDWORD(DataTableEntry[1].GpValue) & 0x20) == 0 )
  {
    ExportedRoutineByName = (int(*)(void))RtlFindExportedRoutineByName(DllBase, (INT8 *)"DllUnload");
    if( !ExportedRoutineByName || ExportedRoutineByName() < 0 )
      return 0;
  }
  return 1;
}

Referenced by: