PsDereferenceVsmEnclave
NTSTATUS __stdcall PsDereferenceVsmEnclave(PVOID P){
signed __int64 v2;
bool v3;
signed __int64 v4;
_QWORD *v5;
_QWORD *v6;
_QWORD *v7;
void *v8;
v2 = _InterlockedExchangeAdd64((volatile signed __int64 *)P + 2, 0xFFFFFFFFFFFFFFFFui64);
v3 = v2 <= 1;
v4 = v2 - 1;
if( v3 )
{
if( v4 )
__fastfail(0xEu);
VslCloseSecureHandle(*((_QWORD *)P + 3));
if( *((_BYTE *)P + 76) )
{
v5 = (_QWORD *)*((_QWORD *)P + 13);
while( v5 )
{
v6 = (_QWORD *)*v5;
if( *v5 || (v6 = (_QWORD *)v5[1]) != 0i64 )
{
v5 = v6;
}
else
{
v7 = (_QWORD *)(v5[2] & 0xFFFFFFFFFFFFFFFCui64);
if( v7 )
{
if( (_QWORD *)*v7 == v5 )
*v7 = 0i64;
else
v7[1] = 0i64;
}
ExFreePoolWithTag(v5, 0);
v5 = v7;
}
}
}
v8 = (void *)*((_QWORD *)P + 15);
if( v8 )
ExFreePoolWithTag(v8, 0);
LODWORD(v4) = (unsigned int)ExFreePoolWithTag(P, 0);
}
return v4;
}Referenced by:
MiCanDeleteEnclave
MiInitializeVsmEnclave
MiTerminateEnclave
PsCallEnclave
PsDeleteVsmEnclave