PfSnNameRemove

UINT64 __stdcall PfSnNameRemove(_PFSN_TRACE_HEADER *Trace, UINT64 FileKey){
  INT64 *v2; 
  unsigned int v5; 
  unsigned __int8 v6; 
  UINT64 *v7; 
  unsigned __int64 v8; 
  UINT64 v9; 
  UINT64 v10; 
  _PFSN_TRACE_HEADER *v12; 
  unsigned __int64 v13; 

  v2 = (INT64 *)(Trace + 144);
  v5 = 0;
  v6 = ExAcquireSpinLockExclusive((INT64 *)Trace + 72);
  v7 = (UINT64 *)(Trace + 130);
  v8 = v6;
  v9 = *((_QWORD *)Trace + 65);
  if( (Trace[132] & 1) != 0 )
  {
    if( v9 )
      v9 ^= (unsigned __int64)v7;
    else
      v9 = 0i64;
  }
  while( 1 )
  {
    if( !v9 )
    {
      ExReleaseSpinLockExclusiveFromDpcLevel(v2);
      __writecr8(v8);
      return v5;
    }
    if( *(_QWORD *)(v9 + 24) > FileKey )
    {
      v10 = *(_QWORD *)v9;
      goto LABEL_10;
    }
    if( *(_QWORD *)(v9 + 24) >= FileKey )
      break;
    v10 = *(_QWORD *)(v9 + 8);
LABEL_10:
    if( (Trace[132] & 1) != 0 && v10 )
      v9 ^= v10;
    else
      v9 = v10;
  }
  RtlRbRemoveNode(v7, v9);
  ExReleaseSpinLockExclusiveFromDpcLevel(v2);
  __writecr8(v8);
  v12 = Trace + 122;
  v13 = 0i64;
  if( (Trace + 130 >= Trace + 122 ? 4 : 0) != 0 )
  {
    do
    {
      if( *(_QWORD *)v12 == FileKey )
        *(_QWORD *)v12 = 0i64;
      v12 += 2;
      ++v13;
    }
    while( v13 < (Trace + 130 >= Trace + 122 ? 4 : 0) );
  }
  v5 = 1;
  ExFreePoolWithTag((PVOID)v9, 0);
  return v5;
}

Referenced by: