MiDeleteCloneDescriptor

PSLIST_ENTRY __fastcall MiDeleteCloneDescriptor(_EPROCESS *Process, INT64 a2){
  __int64 v2; 
  __int64 v5; 
  unsigned __int64 v6; 
  __int64 v7; 

  v2 = *(_QWORD *)(a2 + 56);
  if( _InterlockedExchangeAdd64((volatile signed __int64 *)(v2 + 8), 0xFFFFFFFFFFFFFFFFui64) == 1 )
  {
    v5 = *(_QWORD *)(v2 + 24);
    v6 = *(_QWORD *)(a2 + 32) - *(_QWORD *)(a2 + 24) + 32i64;
    v7 = *(_QWORD *)(v2 + 16);
    *(_QWORD *)(v7 + 24) = (unsigned int)(v6 >> 12) + ((v6 & 0xFFF) != 0);
    RtlpInterlockedPushEntrySList((PSLIST_HEADER)(v5 + 1840), (PSLIST_ENTRY)v7);
    KeSetEvent((PRKEVENT)(v5 + 1808), 0, 0);
    MiDecrementCloneHeaderCount(v5);
    ExFreePoolWithTag((PVOID)v2, 0);
  }
  PsReturnProcessNonPagedPoolQuota(Process, *(_QWORD *)(a2 + 64));
  return RtlpInterlockedPushEntrySList(
           (PSLIST_HEADER)&Process->Vm.Instance.VmWorkingSetList[9].NextPteToAge,
           (PSLIST_ENTRY)(a2 + 80));
}

Referenced by: