MiUnlinkProcessFromSession

__int64 __fastcall MiUnlinkProcessFromSession(__int64 a1){
  __int64 v2; 
  __int64 v3; 
  __int64 v4; 
  _QWORD *v5; 
  __int64 v6; 
  _QWORD *v7; 
  __int64 result; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  memset(&LockHandle, 0, sizeof(LockHandle));
  KeAcquireInStackQueuedSpinLock(&WorkerRoutine, &LockHandle);
  v2 = *(_QWORD *)(a1 + 1368);
  if( v2 )
  {
    v3 = a1 + 1184;
    if( *(_QWORD *)(a1 + 1184) )
    {
      if( (*(_BYTE *)(a1 + 1849) & 1) != 0 && !*(_QWORD *)(v2 + 680) )
        *(_QWORD *)(v2 + 680) = 1i64;
      v4 = *(_QWORD *)v3;
      v5 = *(_QWORD **)(a1 + 1192);
      if( *(_QWORD *)(*(_QWORD *)v3 + 8i64) != v3 || *v5 != v3 )
LABEL_12:
        __fastfail(3u);
      *v5 = v4;
      *(_QWORD *)(v4 + 8) = v5;
    }
  }
  v6 = *(_QWORD *)(a1 + 1984);
  v7 = *(_QWORD **)(a1 + 1992);
  if( *(_QWORD *)(v6 + 8) != a1 + 1984 || *v7 != a1 + 1984 )
    goto LABEL_12;
  *v7 = v6;
  *(_QWORD *)(v6 + 8) = v7;
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  result = (unsigned int)KiIrqlFlags;
  __writecr8(LockHandle.OldIrql);
  return result;
}

Referenced by: