MiSessionRemoveImage

RTL_BALANCED_NODE *__fastcall MiSessionRemoveImage(UINT64 P2, INT64 a2){
  UINT64 v2; 
  __int64 v5; 
  __int64 SessionVm; 
  INT64 *SharedVm; 
  KIRQL v8; 
  UINT8 v9; 
  RTL_BALANCED_NODE *v10; 
  RTL_BALANCED_NODE *v11; 
  RTL_BALANCED_NODE *v14; 
  RTL_BALANCED_NODE *v15; 
  unsigned __int64 i; 
  _RTL_BALANCED_NODE *v17; 
  unsigned __int64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 k; 
  _QWORD *j; 
  unsigned __int64 v22; 
  UINT8 OldIrql; 
  v2 = *(_QWORD *)(P2 + 48);
  OldIrql = 0;
  *(_OWORD *)a2 = 0i64;
  *(_QWORD *)(a2 + 16) = 0i64;
  v5 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64);
  SessionVm = MiGetSessionVm();
  SharedVm = MiGetSharedVm(SessionVm);
  v8 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
  *((_DWORD *)SharedVm + 1) = 0;
  v9 = v8;
  MmLockLoadedModuleListExclusive(&OldIrql);
  v10 = MiSessionLookupImage(v2);
  v11 = v10;
  if( !v10 )
    KeBugCheckEx(0x1Au, 0x2100ui64, P2, v2, 0i64);
  if( HIDWORD(v10[2].Right)-- == 1 )
  {
    v14 = v10->Children[0];
    v15 = v10;
    if( v10->Children[0] )
    {
      for( ; v14->Children[1]; v14 = v14->Children[1] )
        ;
    }
    else
    {
      for( i = v10->ParentValue; ; i = v14->ParentValue )
      {
        v14 = (RTL_BALANCED_NODE *)(i & 0xFFFFFFFFFFFFFFFCui64);
        if( !v14 || v14->Children[1] == v15 )
          break;
        v15 = v14;
      }
    }
    if( v14 )
      v17 = v14[2].Children[0];
    else
      v17 = 0i64;
    v18 = (unsigned __int64)v11->Children[1];
    v19 = (unsigned __int64)v11;
    *(_QWORD *)a2 = v17;
    if( v18 )
    {
      for( j = *(_QWORD **)v18; j; j = (_QWORD *)*j )
        v18 = (unsigned __int64)j;
    }
    else
    {
      for( k = v11->ParentValue; ; k = *(_QWORD *)(v18 + 16) )
      {
        v18 = k & 0xFFFFFFFFFFFFFFFCui64;
        if( !v18 || *(_QWORD *)v18 == v19 )
          break;
        v19 = v18;
      }
    }
    if( v18 )
      v22 = *(_QWORD *)(v18 + 40) & 0xFFFFFFFFFFFFFFFCui64;
    else
      v22 = 0i64;
    *(_QWORD *)(a2 + 8) = v22;
    RtlAvlRemoveNode((unsigned __int64 *)(v5 + 88), (__int64 *)v11);
    *(_QWORD *)(a2 + 16) = v11[3].Children[0];
  }
  else
  {
    v11 = 0i64;
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)PsLoadedModuleSpinLock);
  __writecr8(OldIrql);
  MiUnlockWorkingSetExclusive(SessionVm, v9);
  if( v11 && *(_BYTE *)&v11[2].0 == 1 )
    MiHandleDriverNonPagedSections(P2, 0, 0);
  return v11;
}

Referenced by: