MiDeleteCloneDescriptor

PSLIST_ENTRY __fastcall MiDeleteCloneDescriptor(ULONG_PTR a1, __int64 a2){
  __int64 v2; 
  INT64 v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  v2 = *(_QWORD *)(a2 + 56);
  if( _InterlockedExchangeAdd64((volatile signed __int64 *)(v2 + 8), 0xFFFFFFFFFFFFFFFFui64) == 1 )
  {
    v5 = *(_QWORD *)(v2 + 24);
    v6 = *(_QWORD *)(a2 + 32) - *(_QWORD *)(a2 + 24) + 32i64;
    v7 = *(_QWORD *)(v2 + 16);
    *(_QWORD *)(v7 + 24) = (unsigned int)(v6 >> 12) + ((v6 & 0xFFF) != 0);
    RtlpInterlockedPushEntrySList((PSLIST_HEADER)(v5 + 1840), (PSLIST_ENTRY)v7);
    KeSetEvent((PRKEVENT)(v5 + 1808), 0);
    MiDecrementCloneHeaderCount(v5);
    ExFreePoolWithTag((PVOID)v2, 0);
  }
  PsReturnProcessNonPagedPoolQuota(a1, *(_QWORD *)(a2 + 64));
  return RtlpInterlockedPushEntrySList((PSLIST_HEADER)(*(_QWORD *)(a1 + 1680) + 368i64), (PSLIST_ENTRY)(a2 + 80));
}

Referenced by: