AlpcpDeleteBlob
UINT8 __stdcall AlpcpDeleteBlob(PVOID Blob){
volatile INT64 *v1;
char v3;
v1 = (volatile INT64 *)((char *)Blob - 16);
ExAcquirePushLockExclusiveEx((UINT64)Blob - 16, 0i64);
v3 = *((char *)Blob - 32);
if( (v3 & 8) != 0 )
{
if( (_InterlockedExchangeAdd64(v1, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v1);
KeAbPostRelease((PVOID)v1);
return 0;
}
else
{
*((char *)Blob - 32) = v3 | 8;
if( (_InterlockedExchangeAdd64(v1, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v1);
KeAbPostRelease((PVOID)v1);
(*(void(__fastcall **)(PVOID))(AlpcpRegisteredTypes[(unsigned __int8)*((char *)Blob - 31)] + 32))(Blob);
return 1;
}
}Referenced by:
AlpcpCaptureSecurityAttributeInternal
AlpcpDeleteView
AlpcpMapLegacyPortView
NtAlpcDeletePortSection
NtAlpcDeleteResourceReserve
NtAlpcDeleteSecurityContext