MiUnloadApproved

__int64 __fastcall MiUnloadApproved(ULONG_PTR BugCheckParameter2){
  void *v1; 
  INT8 v3; 
  __int16 v4; 
  RTL_BALANCED_NODE *v6; 
  RTL_BALANCED_NODE *v7; 
  int Right_high; 
  int(*v9)(void); 
  __int64 v10; 
  v1 = *(void **)(BugCheckParameter2 + 48);
  if( (unsigned int)MiGetSystemRegionType((UINT64)v1) == 1 )
  {
    v6 = MiSessionLookupImage((UINT64)v1);
    v7 = v6;
    if( !v6 )
    {
      v10 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64);
      if( (*(_DWORD *)(v10 + 4) & 2) == 0 )
        KeBugCheckEx(0x1Au, 0x2200ui64, BugCheckParameter2, (ULONG_PTR)v1, *(unsigned int *)(v10 + 8));
      return 0i64;
    }
    Right_high = HIDWORD(v6[2].Right);
    if( Right_high != 1 )
    {
      HIDWORD(v7[2].Right) = Right_high - 1;
      return 0i64;
    }
  }
  else
  {
    v4 = *(_WORD *)(BugCheckParameter2 + 108);
    if( v4 != 1 )
    {
      *(_WORD *)(BugCheckParameter2 + 108) = v4 - 1;
      return 0i64;
    }
  }
  if( (*(_DWORD *)(BugCheckParameter2 + 196) & 0x20) == 0 )
  {
    LODWORD(v9) = RtlFindExportedRoutineByName(v1, (PSTR)"DllUnload", v3);
    if( !v9 || v9() < 0 )
      return 0i64;
  }
  return 1i64;
}

Referenced by: