ExpWnfDeleteProcessContext

VOID __stdcall ExpWnfDeleteProcessContext(_WNF_PROCESS_CONTEXT *ProcessContext, UINT64 FinalCleanup){
  _WNF_LOCK *p_ProcessSubscriptionListLock; 
  int v3; 
  _BYTE *v5; 
  _BYTE *v6; 
  _LIST_ENTRY *p_ProcessSubscriptionListHead; 
  _LIST_ENTRY *Flink; 
  _LIST_ENTRY **p_Blink; 
  _BYTE *v10; 
  _BYTE *v11; 
  _WNF_LOCK *p_TemporaryNamesListLock; 
  _BYTE *v13; 
  _BYTE *v14; 
  _LIST_ENTRY *p_TemporaryNamesListHead; 
  _LIST_ENTRY *v16; 
  _BYTE *v17; 
  _BYTE *v18; 
  _LIST_ENTRY *v19; 
  _LIST_ENTRY *Blink; 
  _KEVENT *NotificationEvent; 
  _WNF_NAME_INSTANCE *v22; 
  _BYTE *v23; 
  _BYTE *v24; 

  p_ProcessSubscriptionListLock = &ProcessContext->ProcessSubscriptionListLock;
  v3 = FinalCleanup;
  v5 = KeAbPreAcquire(&ProcessContext->ProcessSubscriptionListLock, 0i64, 0i64);
  v6 = v5;
  if( _interlockedbittestandset64((volatile signed __int32 *)p_ProcessSubscriptionListLock, 0i64) )
    ExfAcquirePushLockExclusiveEx(&p_ProcessSubscriptionListLock->PushLock, v5, p_ProcessSubscriptionListLock);
  if( v6 )
    v6[26] |= 1u;
  p_ProcessSubscriptionListHead = &ProcessContext->ProcessSubscriptionListHead;
  while( 1 )
  {
    Flink = p_ProcessSubscriptionListHead->Flink;
    if( p_ProcessSubscriptionListHead->Flink == p_ProcessSubscriptionListHead )
      break;
    p_Blink = &Flink[-2].Blink;
    ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&Flink[-1]);
    if( (_InterlockedExchangeAdd64(&p_ProcessSubscriptionListLock->PushLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&p_ProcessSubscriptionListLock->PushLock);
    KeAbPostRelease(p_ProcessSubscriptionListLock);
    ExpWnfDeleteSubscription(p_Blink, ProcessContext->Process);
    v10 = KeAbPreAcquire(p_ProcessSubscriptionListLock, 0i64, 0i64);
    v11 = v10;
    if( _interlockedbittestandset64((volatile signed __int32 *)p_ProcessSubscriptionListLock, 0i64) )
      ExfAcquirePushLockExclusiveEx(&p_ProcessSubscriptionListLock->PushLock, v10, p_ProcessSubscriptionListLock);
    if( v11 )
      v11[26] |= 1u;
  }
  if( (_InterlockedExchangeAdd64(&p_ProcessSubscriptionListLock->PushLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&p_ProcessSubscriptionListLock->PushLock);
  KeAbPostRelease(p_ProcessSubscriptionListLock);
  p_TemporaryNamesListLock = &ProcessContext->TemporaryNamesListLock;
  v13 = KeAbPreAcquire(&ProcessContext->TemporaryNamesListLock, 0i64, 0i64);
  v14 = v13;
  if( _interlockedbittestandset64((volatile signed __int32 *)&ProcessContext->TemporaryNamesListLock, 0i64) )
    ExfAcquirePushLockExclusiveEx(
      &ProcessContext->TemporaryNamesListLock.PushLock,
      v13,
      &ProcessContext->TemporaryNamesListLock);
  if( v14 )
    v14[26] |= 1u;
  p_TemporaryNamesListHead = &ProcessContext->TemporaryNamesListHead;
  while( 1 )
  {
    v16 = p_TemporaryNamesListHead->Flink;
    if( p_TemporaryNamesListHead->Flink == p_TemporaryNamesListHead )
      break;
    v22 = (_WNF_NAME_INSTANCE *)&v16[-9].Blink;
    ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&v16[-8]);
    if( (_InterlockedExchangeAdd64(&p_TemporaryNamesListLock->PushLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&ProcessContext->TemporaryNamesListLock.PushLock);
    KeAbPostRelease(&ProcessContext->TemporaryNamesListLock);
    ExpWnfNotifyNameSubscribers(v22, 0x10ui64, 0i64, 0i64);
    ExpWnfDeleteNameInstance(v22->ScopeInstance, v22, 1u);
    v23 = KeAbPreAcquire(&ProcessContext->TemporaryNamesListLock, 0i64, 0i64);
    v24 = v23;
    if( _interlockedbittestandset64((volatile signed __int32 *)p_TemporaryNamesListLock, 0i64) )
      ExfAcquirePushLockExclusiveEx(
        &ProcessContext->TemporaryNamesListLock.PushLock,
        v23,
        &ProcessContext->TemporaryNamesListLock);
    if( v24 )
      v24[26] |= 1u;
  }
  if( (_InterlockedExchangeAdd64(&p_TemporaryNamesListLock->PushLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&ProcessContext->TemporaryNamesListLock.PushLock);
  KeAbPostRelease(&ProcessContext->TemporaryNamesListLock);
  if( v3 )
  {
    v17 = KeAbPreAcquire(&ExpWnfProcessesListLock, 0i64, 0i64);
    v18 = v17;
    if( _interlockedbittestandset64((volatile signed __int32 *)&ExpWnfProcessesListLock, 0i64) )
      ExfAcquirePushLockExclusiveEx(&ExpWnfProcessesListLock, v17, &ExpWnfProcessesListLock);
    if( v18 )
      v18[26] |= 1u;
    v19 = ProcessContext->WnfProcessesListEntry.Flink;
    if( v19->Blink != &ProcessContext->WnfProcessesListEntry
      || (Blink = ProcessContext->WnfProcessesListEntry.Blink, Blink->Flink != &ProcessContext->WnfProcessesListEntry) )
    {
      __fastfail(3u);
    }
    Blink->Flink = v19;
    v19->Blink = Blink;
    if( (_InterlockedExchangeAdd64(&ExpWnfProcessesListLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&ExpWnfProcessesListLock);
    KeAbPostRelease(&ExpWnfProcessesListLock);
    NotificationEvent = ProcessContext->NotificationEvent;
    if( NotificationEvent )
      HalPutDmaAdapter((PADAPTER_OBJECT)NotificationEvent);
    ExFreePoolWithTag(ProcessContext, 0x20666E57u);
  }
}

Referenced by: