CmpVERemoveHiveFromSIDMappingTable

VOID __fastcall CmpVERemoveHiveFromSIDMappingTable(INT64 a1){
  unsigned int v2; 
  _QWORD *v3; 
  __int64 v4; 

  if( (*(_DWORD *)(a1 + 4152) & 2) != 0 )
  {
    ExAcquireFastMutex((PFAST_MUTEX)((char *)&CmpDummyThreadEvent + 736));
    v2 = 0;
    if( CmpSIDToHiveMappingCount )
    {
      v3 = (char *)CmpSIDToHiveMapping + 24;
      do
      {
        if( *v3 == a1 )
          break;
        ++v2;
        v3 += 4;
      }
      while( v2 < CmpSIDToHiveMappingCount );
    }
    v4 = 32i64 * v2;
    ExFreePoolWithTag(*(PVOID *)((char *)CmpSIDToHiveMapping + v4 + 8), 0);
    memmove(
      (char *)CmpSIDToHiveMapping + v4,
      (char *)CmpSIDToHiveMapping + 32 * v2 + 32,
      32 * (--CmpSIDToHiveMappingCount - v2));
    KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&CmpDummyThreadEvent + 736));
  }
}

Referenced by: