PspDeleteCreateProcessContext

VOID __stdcall PspDeleteCreateProcessContext(_PSP_CREATE_PROCESS_CONTEXT *CreateContext){
  VOID *v2; 
  _ADAPTER_OBJECT *v3; 
  _ADAPTER_OBJECT *v4; 
  VOID *v5; 
  VOID *v6; 
  VOID *v7; 
  _ADAPTER_OBJECT *v8; 
  _PSP_CREATE_PROCESS_CONTEXT *v9; 
  void *v10; 
  VOID **v11; 
  VOID *v12; 
  VOID *v13; 
  __int64 v14; 
  void *v15; 
  unsigned __int64 v16; 
  VOID **v17; 
  void *v18; 

  v2 = (VOID *)*((_QWORD *)CreateContext + 21);
  if( v2 )
    ObCloseHandle(v2, 0);
  v3 = (_ADAPTER_OBJECT *)*((_QWORD *)CreateContext + 22);
  if( v3 )
    HalPutDmaAdapter(v3);
  v4 = (_ADAPTER_OBJECT *)*((_QWORD *)CreateContext + 19);
  if( v4 )
    HalPutDmaAdapter(v4);
  v5 = (VOID *)*((_QWORD *)CreateContext + 16);
  if( v5 )
    ObfDereferenceObjectWithTag(v5, 0x72437350ui64);
  v6 = (VOID *)*((_QWORD *)CreateContext + 23);
  if( v6 )
    ObCloseHandle(v6, 0);
  v7 = (VOID *)*((_QWORD *)CreateContext + 24);
  if( v7 )
    ObCloseHandle(v7, 0);
  v8 = (_ADAPTER_OBJECT *)*((_QWORD *)CreateContext + 25);
  if( v8 )
    HalPutDmaAdapter(v8);
  if( (CreateContext[2] & 4) != 0 )
    ExFreePoolWithTag(*((PVOID *)CreateContext + 26), 0);
  v9 = (_PSP_CREATE_PROCESS_CONTEXT *)*((_QWORD *)CreateContext + 35);
  if( v9 && v9 != CreateContext + 66 )
    ExFreePoolWithTag(v9, 0);
  v10 = (void *)*((_QWORD *)CreateContext + 37);
  if( v10 )
    ExFreePoolWithTag(v10, 0);
  v11 = (VOID **)*((_QWORD *)CreateContext + 50);
  if( v11 )
  {
    v16 = 0i64;
    if( CreateContext[103] )
    {
      v17 = (VOID **)*((_QWORD *)CreateContext + 50);
      do
      {
        if( v11[v16] )
        {
          ObfDereferenceObjectWithTag(v11[v16], 0x6C4A7350ui64);
          v11 = (VOID **)*((_QWORD *)CreateContext + 50);
          v17 = v11;
        }
        ++v16;
      }
      while( v16 < (unsigned int)CreateContext[103] );
      v11 = v17;
    }
    ExFreePoolWithTag(v11, 0x6C4A7350u);
  }
  v12 = (VOID *)*((_QWORD *)CreateContext + 49);
  if( v12 )
  {
    memset(v12, 0i64, CreateContext[102]);
    ExFreePoolWithTag(*((PVOID *)CreateContext + 49), 0);
  }
  v13 = (VOID *)*((_QWORD *)CreateContext + 53);
  if( v13 )
  {
    memset(v13, 0i64, CreateContext[108]);
    ExFreePoolWithTag(*((PVOID *)CreateContext + 53), 0);
  }
  v14 = *((_QWORD *)CreateContext + 55);
  if( v14 )
  {
    v18 = *(void **)(v14 + 8);
    if( v18 || (v18 = *(void **)(v14 + 24)) != 0i64 )
      ExFreePoolWithTag(v18, 0);
    ExFreePoolWithTag(*((PVOID *)CreateContext + 55), 0);
  }
  v15 = (void *)*((_QWORD *)CreateContext + 59);
  if( v15 )
  {
    ExFreePoolWithTag(v15, 0);
    *((_QWORD *)CreateContext + 59) = 0i64;
  }
  RtlFreeAnsiString((_UNICODE_STRING *)(CreateContext + 58));
  PspDestroyProcessParameterOverrides(*((_QWORD *)CreateContext + 64));
}

Referenced by:

NtCreateThreadEx
NtCreateUserProcess
PspBuildCreateProcessContext