WbFreeMemoryBlock
NTSTATUS __stdcall WbFreeMemoryBlock(PVOID *BaseAddress){
INT64 v1;
_EPROCESS *Process;
int v4;
_MDL *v5;
NTSTATUS result;
VOID *v7;
if( BaseAddress )
{
Process = KeGetCurrentThread()->ApcState.Process;
if( BaseAddress[2] == Process )
{
v7 = BaseAddress[135];
v4 = 1;
if( v7 )
MmUnsecureVirtualMemory(v7);
}
else
{
v4 = 0;
}
v5 = (_MDL *)BaseAddress[3];
if( v5 )
{
sub_14064F46C(v5, (INT64)Process, v1);
BaseAddress[3] = 0i64;
}
BaseAddress[4] = 0i64;
if( *BaseAddress )
{
if( v4 )
ZwFreeVirtualMemory((VOID *)0xFFFFFFFFFFFFFFFFi64, BaseAddress, (UINT64 *)BaseAddress + 1, 0x8000ui64);
*BaseAddress = 0i64;
BaseAddress[1] = 0i64;
}
return(unsigned int)ExFreePoolWithTag(BaseAddress, 0x42524157u);
}
return result;
}Referenced by:
WbAllocateMemoryBlock
WbAllocateUserMemory
WbFreeWarbirdProcess