AlpcpForceUnlinkSecureView
void __fastcall AlpcpForceUnlinkSecureView(ULONG_PTR a1){
_QWORD *v1;
_KPROCESS *v2;
ULONG_PTR v3;
_KAPC_STATE ApcState;
v2 = *(_EPROCESS **)(a1 + 32);
v3 = a1;
v1 = *(_QWORD **)(a1 + 16);
memset(&ApcState, 0, sizeof(ApcState));
AlpcpLockForCachedReferenceBlob(v1);
if( v3 == v1[9] )
{
if( *(_QWORD *)(v3 + 64) )
{
KiStackAttachProcess((_KPROCESS *)v2, 0i64, &ApcState);
MmUnsecureVirtualMemory(*(PVOID *)(v3 + 64));
KiUnstackDetachProcess(&ApcState, 0i64);
*(_QWORD *)(v3 + 64) = 0i64;
}
*(_DWORD *)(v3 + 72) |= 1u;
v1[9] = 0i64;
*(_DWORD *)(v3 + 72) |= 4u;
}
else
{
v3 = 0i64;
}
AlpcpUnlockBlob(v1);
if( v3 )
AlpcpDereferenceBlobEx((PVOID)v3, 1i64);
}Referenced by:
AlpcpCleanupProcessViews