IopCheckUnloadDriver

NTSTATUS __stdcall IopCheckUnloadDriver(DRIVER_OBJECT *driverObject, UINT8 *unloadDriver){
  KIRQL v4; 
  _DEVICE_OBJECT *DeviceObject; 
  NTSTATUS v6; 
  unsigned int Flags; 
  UINT8 v8; 
  v4 = KeAcquireQueuedSpinLock(0xAui64);
  DeviceObject = driverObject->DeviceObject;
  v6 = 0;
  if( !DeviceObject && (driverObject->Flags & 1) != 0 )
    goto LABEL_15;
  Flags = driverObject->Flags;
  if( (Flags & 0x80u) == 0 && DeviceObject && (*(_DWORD *)(*((_QWORD *)DeviceObject + 39) + 32i64) & 1) != 0 )
    goto LABEL_15;
  if( (Flags & 0x10) == 0 )
  {
    v6 = -1073741808;
LABEL_15:
    KeReleaseQueuedSpinLock(0xAui64, v4);
    ObfDereferenceObjectWithTag(driverObject, 0x746C6644ui64);
    return v6;
  }
  *unloadDriver = 1;
  v8 = 1;
  while( DeviceObject )
  {
    *(_DWORD *)(*((_QWORD *)DeviceObject + 39) + 32i64) |= 1u;
    if( *((_DWORD *)DeviceObject + 1) || *((_QWORD *)DeviceObject + 3) )
    {
      *unloadDriver = 0;
      v8 = 0;
    }
    else
    {
      v8 = *unloadDriver;
    }
    DeviceObject = (_DEVICE_OBJECT *)*((_QWORD *)DeviceObject + 2);
  }
  if( (driverObject->Flags & 0x80u) != 0 && driverObject->DeviceObject )
  {
    *unloadDriver = 0;
    v8 = 0;
  }
  if( v8 )
    driverObject->Flags |= 1u;
  KeReleaseQueuedSpinLock(0xAui64, v4);
  return -1073741823;
}

Referenced by: