PspDeleteCreateProcessContext
VOID __stdcall PspDeleteCreateProcessContext(_PSP_CREATE_PROCESS_CONTEXT *CreateContext){
VOID *v2;
_ADAPTER_OBJECT *v3;
_ADAPTER_OBJECT *v4;
VOID *v5;
VOID *v6;
VOID *v7;
_ADAPTER_OBJECT *v8;
_PSP_CREATE_PROCESS_CONTEXT *v9;
void *v10;
VOID **v11;
VOID *v12;
VOID *v13;
__int64 v14;
void *v15;
unsigned __int64 v16;
VOID **v17;
void *v18;
v2 = (VOID *)*((_QWORD *)CreateContext + 21);
if( v2 )
ObCloseHandle(v2, 0);
v3 = (_ADAPTER_OBJECT *)*((_QWORD *)CreateContext + 22);
if( v3 )
HalPutDmaAdapter(v3);
v4 = (_ADAPTER_OBJECT *)*((_QWORD *)CreateContext + 19);
if( v4 )
HalPutDmaAdapter(v4);
v5 = (VOID *)*((_QWORD *)CreateContext + 16);
if( v5 )
ObfDereferenceObjectWithTag(v5, 0x72437350ui64);
v6 = (VOID *)*((_QWORD *)CreateContext + 23);
if( v6 )
ObCloseHandle(v6, 0);
v7 = (VOID *)*((_QWORD *)CreateContext + 24);
if( v7 )
ObCloseHandle(v7, 0);
v8 = (_ADAPTER_OBJECT *)*((_QWORD *)CreateContext + 25);
if( v8 )
HalPutDmaAdapter(v8);
if( (CreateContext[2] & 4) != 0 )
ExFreePoolWithTag(*((PVOID *)CreateContext + 26), 0);
v9 = (_PSP_CREATE_PROCESS_CONTEXT *)*((_QWORD *)CreateContext + 35);
if( v9 && v9 != CreateContext + 66 )
ExFreePoolWithTag(v9, 0);
v10 = (void *)*((_QWORD *)CreateContext + 37);
if( v10 )
ExFreePoolWithTag(v10, 0);
v11 = (VOID **)*((_QWORD *)CreateContext + 50);
if( v11 )
{
v16 = 0i64;
if( CreateContext[103] )
{
v17 = (VOID **)*((_QWORD *)CreateContext + 50);
do
{
if( v11[v16] )
{
ObfDereferenceObjectWithTag(v11[v16], 0x6C4A7350ui64);
v11 = (VOID **)*((_QWORD *)CreateContext + 50);
v17 = v11;
}
++v16;
}
while( v16 < (unsigned int)CreateContext[103] );
v11 = v17;
}
ExFreePoolWithTag(v11, 0x6C4A7350u);
}
v12 = (VOID *)*((_QWORD *)CreateContext + 49);
if( v12 )
{
memset(v12, 0i64, CreateContext[102]);
ExFreePoolWithTag(*((PVOID *)CreateContext + 49), 0);
}
v13 = (VOID *)*((_QWORD *)CreateContext + 53);
if( v13 )
{
memset(v13, 0i64, CreateContext[108]);
ExFreePoolWithTag(*((PVOID *)CreateContext + 53), 0);
}
v14 = *((_QWORD *)CreateContext + 55);
if( v14 )
{
v18 = *(void **)(v14 + 8);
if( v18 || (v18 = *(void **)(v14 + 24)) != 0i64 )
ExFreePoolWithTag(v18, 0);
ExFreePoolWithTag(*((PVOID *)CreateContext + 55), 0);
}
v15 = (void *)*((_QWORD *)CreateContext + 59);
if( v15 )
{
ExFreePoolWithTag(v15, 0);
*((_QWORD *)CreateContext + 59) = 0i64;
}
RtlFreeAnsiString((_UNICODE_STRING *)(CreateContext + 58));
PspDestroyProcessParameterOverrides(*((_QWORD *)CreateContext + 64));
}Referenced by:
NtCreateThreadEx
NtCreateUserProcess
PspBuildCreateProcessContext