SeUnregisterLogonSessionTerminatedRoutine

INT64 __stdcall SeUnregisterLogonSessionTerminatedRoutine(INT64 *CallbackRoutine, _LUID *a2){
  unsigned int v2; 
  _ETHREAD *CurrentThread; 
  INT64 *v6; 
  PVOID *v7; 
  v2 = 0;
  if( !CallbackRoutine )
    return 3221225485i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquireFastMutexUnsafe(&SepRmNotifyMutex);
  v6 = (INT64 *)SeFileSystemNotifyRoutinesHead;
  v7 = &SeFileSystemNotifyRoutinesHead;
  if( !SeFileSystemNotifyRoutinesHead )
    goto LABEL_8;
  do
  {
    if( (INT64 *)v6[1] == CallbackRoutine )
      break;
    v7 = (PVOID *)v6;
    v6 = (INT64 *)*v6;
  }
  while( v6 );
  if( v6 )
  {
    *v7 = (PVOID)*v6;
    ExReleaseFastMutexUnsafe(&SepRmNotifyMutex);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    ExFreePoolWithTag(v6, 0);
  }
  else
  {
LABEL_8:
    ExReleaseFastMutexUnsafe(&SepRmNotifyMutex);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    return(unsigned int)-1073741275;
  }
  return v2;
}

Referenced by: