ObpFreeObjectNameBuffer
VOID __stdcall ObpFreeObjectNameBuffer(_UNICODE_STRING *ObjectName){
struct _SLIST_ENTRY *Buffer;
struct _KPRCB *CurrentPrcb;
__int64 v3;
Buffer = (struct _SLIST_ENTRY *)ObjectName->Buffer;
if( ObjectName->MaximumLength == 248 )
{
CurrentPrcb = KeGetCurrentPrcb();
v3 = *((_QWORD *)CurrentPrcb + 266);
++*(_DWORD *)(v3 + 28);
if( *(_WORD *)v3 < *(_WORD *)(v3 + 16)
|| (++*(_DWORD *)(v3 + 32),
v3 = *((_QWORD *)CurrentPrcb + 267),
++*(_DWORD *)(v3 + 28),
*(_WORD *)v3 < *(_WORD *)(v3 + 16)) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v3, Buffer);
}
else
{
++*(_DWORD *)(v3 + 32);
(*(void(__fastcall **)(struct _SLIST_ENTRY *))(v3 + 56))(Buffer);
}
}
else
{
ExFreePoolWithTag(ObjectName->Buffer, 0);
}
}Referenced by:
CmpCreateKeyBody
IopAllocRealFileObject
ObCreateObjectEx
ObReferenceObjectByName
ObReferenceObjectByNameEx