MiFreeCloneDescriptor
VOID __stdcall MiFreeCloneDescriptor(ULONG_PTR CurrentProcess, ULONG_PTR CloneDescriptor){
_QWORD *v2;
UINT64 v3;
UINT64 v4;
void *v5;
_EPROCESS *v6;
char *v7;
v2 = *(_QWORD **)(*(_QWORD *)&CloneDescriptor + 56i64);
v3 = 0i64;
v4 = *(_QWORD *)(*(_QWORD *)&CloneDescriptor + 64i64);
v5 = *(void **)&CloneDescriptor;
v6 = *(_EPROCESS **)&CurrentProcess;
v7 = (char *)v2[2];
if( v4 )
{
do
{
MiUnlockPagedAddress(&v7[v3]);
v3 += 4096i64;
}
while( v3 < v4 );
}
PsReturnProcessNonPagedPoolQuota(v6, v4);
MiDecrementCloneHeaderCount(v2[3]);
ExFreePoolWithTag(v2, 0);
ExFreePoolWithTag(v7, 0);
ExFreePoolWithTag(v5, 0);
}Referenced by:
MiCloneProcessAddressSpace
MiCloneVads