ExpWnfDeleteProcessContext

VOID __fastcall ExpWnfDeleteProcessContext(_WNF_PROCESS_CONTEXT *ProcessContext, UINT64 FinalCleanup){
  _WNF_LOCK *p_ProcessSubscriptionListLock; 
  int v3; 
  _BYTE *v5; 
  _BYTE *v6; 
  _LIST_ENTRY *p_ProcessSubscriptionListHead; 
  _LIST_ENTRY *Flink; 
  _LIST_ENTRY **p_Blink; 
  _BYTE *v10; 
  _BYTE *v11; 
  _WNF_LOCK *p_TemporaryNamesListLock; 
  _BYTE *v13; 
  _BYTE *v14; 
  _LIST_ENTRY *p_TemporaryNamesListHead; 
  _LIST_ENTRY *v16; 
  _BYTE *v17; 
  _BYTE *v18; 
  _LIST_ENTRY *v19; 
  _LIST_ENTRY *Blink; 
  _KEVENT *NotificationEvent; 
  _WNF_NAME_INSTANCE *v22; 
  _BYTE *v23; 
  _BYTE *v24; 
  p_ProcessSubscriptionListLock = &ProcessContext->ProcessSubscriptionListLock;
  v3 = FinalCleanup;
  LODWORD(v5) = KeAbPreAcquire(&ProcessContext->ProcessSubscriptionListLock, 0i64, 0i64);
  v6 = v5;
  if( _interlockedbittestandset64((volatile signed __int32 *)p_ProcessSubscriptionListLock, 0i64) )
    ExfAcquirePushLockExclusiveEx((UINT64 *)p_ProcessSubscriptionListLock, v5, p_ProcessSubscriptionListLock);
  if( v6 )
    v6[26] |= 1u;
  p_ProcessSubscriptionListHead = &ProcessContext->ProcessSubscriptionListHead;
  while( 1 )
  {
    Flink = p_ProcessSubscriptionListHead->Flink;
    if( p_ProcessSubscriptionListHead->Flink == p_ProcessSubscriptionListHead )
      break;
    p_Blink = &Flink[-2].Blink;
    ExAcquireRundownProtection((PEX_RUNDOWN_REF)&Flink[-1]);
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)p_ProcessSubscriptionListLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)p_ProcessSubscriptionListLock);
    KeAbPostRelease(p_ProcessSubscriptionListLock);
    ExpWnfDeleteSubscription(p_Blink, ProcessContext->Process);
    LODWORD(v10) = KeAbPreAcquire(p_ProcessSubscriptionListLock, 0i64, 0i64);
    v11 = v10;
    if( _interlockedbittestandset64((volatile signed __int32 *)p_ProcessSubscriptionListLock, 0i64) )
      ExfAcquirePushLockExclusiveEx((UINT64 *)p_ProcessSubscriptionListLock, v10, p_ProcessSubscriptionListLock);
    if( v11 )
      v11[26] |= 1u;
  }
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)p_ProcessSubscriptionListLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)p_ProcessSubscriptionListLock);
  KeAbPostRelease(p_ProcessSubscriptionListLock);
  p_TemporaryNamesListLock = &ProcessContext->TemporaryNamesListLock;
  LODWORD(v13) = KeAbPreAcquire(&ProcessContext->TemporaryNamesListLock, 0i64, 0i64);
  v14 = v13;
  if( _interlockedbittestandset64((volatile signed __int32 *)&ProcessContext->TemporaryNamesListLock, 0i64) )
    ExfAcquirePushLockExclusiveEx(
      (UINT64 *)&ProcessContext->TemporaryNamesListLock,
      v13,
      &ProcessContext->TemporaryNamesListLock);
  if( v14 )
    v14[26] |= 1u;
  p_TemporaryNamesListHead = &ProcessContext->TemporaryNamesListHead;
  while( 1 )
  {
    v16 = p_TemporaryNamesListHead->Flink;
    if( p_TemporaryNamesListHead->Flink == p_TemporaryNamesListHead )
      break;
    v22 = (_WNF_NAME_INSTANCE *)&v16[-9].Blink;
    ExAcquireRundownProtection((PEX_RUNDOWN_REF)&v16[-8]);
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)p_TemporaryNamesListLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)&ProcessContext->TemporaryNamesListLock);
    KeAbPostRelease(&ProcessContext->TemporaryNamesListLock);
    ExpWnfNotifyNameSubscribers((INT64)v22, 0x10ui64, 0i64, 0i64);
    ExpWnfDeleteNameInstance(v22->ScopeInstance, v22, 1u);
    LODWORD(v23) = KeAbPreAcquire(&ProcessContext->TemporaryNamesListLock, 0i64, 0i64);
    v24 = v23;
    if( _interlockedbittestandset64((volatile signed __int32 *)p_TemporaryNamesListLock, 0i64) )
      ExfAcquirePushLockExclusiveEx(
        (UINT64 *)&ProcessContext->TemporaryNamesListLock,
        v23,
        &ProcessContext->TemporaryNamesListLock);
    if( v24 )
      v24[26] |= 1u;
  }
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)p_TemporaryNamesListLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&ProcessContext->TemporaryNamesListLock);
  KeAbPostRelease(&ProcessContext->TemporaryNamesListLock);
  if( v3 )
  {
    LODWORD(v17) = KeAbPreAcquire(&ExpWnfProcessesListLock, 0i64, 0i64);
    v18 = v17;
    if( _interlockedbittestandset64((volatile signed __int32 *)&ExpWnfProcessesListLock, 0i64) )
      ExfAcquirePushLockExclusiveEx(&ExpWnfProcessesListLock, v17, &ExpWnfProcessesListLock);
    if( v18 )
      v18[26] |= 1u;
    v19 = ProcessContext->WnfProcessesListEntry.Flink;
    if( v19->Blink != &ProcessContext->WnfProcessesListEntry
      || (Blink = ProcessContext->WnfProcessesListEntry.Blink, Blink->Flink != &ProcessContext->WnfProcessesListEntry) )
    {
      __fastfail(3u);
    }
    Blink->Flink = v19;
    v19->Blink = Blink;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&ExpWnfProcessesListLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)&ExpWnfProcessesListLock);
    KeAbPostRelease(&ExpWnfProcessesListLock);
    NotificationEvent = ProcessContext->NotificationEvent;
    if( NotificationEvent )
      HalPutDmaAdapter((PADAPTER_OBJECT)NotificationEvent);
    ExFreePoolWithTag(ProcessContext, 0x20666E57u);
  }
}

Referenced by: