NtUnmapViewOfSectionEx

NTSTATUS __stdcall NtUnmapViewOfSectionEx(VOID *ProcessHandle, VOID *BaseAddress, UINT64 Flags){
  char v3; 
  char PreviousMode; 
  NTSTATUS result; 
  NTSTATUS v7; 
  UINT64 Tag; 
  PVOID Object; 

  Object = 0i64;
  v3 = Flags;
  if( (Flags & 0xFFFFFFFC) != 0 )
    return -1073741583;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode == 1 && (unsigned __int64)BaseAddress > 0x7FFFFFFEFFFFi64 )
    return -1073741799;
  LODWORD(Tag) = 2002152781;
  result = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             8ui64,
             (_OBJECT_TYPE *)PsProcessType,
             PreviousMode,
             Tag,
             &Object,
             0i64);
  if( result >= 0 )
  {
    v7 = MiUnmapViewOfSection((_EPROCESS *)Object, BaseAddress, v3 & 1);
    ObfDereferenceObjectWithTag(Object, 0x77566D4Dui64);
    return v7;
  }
  return result;
}

Referenced by: