ExpRemoveHandleTable
_QWORD *__fastcall ExpRemoveHandleTable(__int64 a1){
_ETHREAD *CurrentThread;
_QWORD *v3;
__int64 v4;
_QWORD *v5;
_QWORD *result;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)&HandleTableListLock, 0i64);
v3 = (_QWORD *)(a1 + 24);
v4 = *v3;
if( *(_QWORD **)(*v3 + 8i64) != v3 || (v5 = (_QWORD *)v3[1], (_QWORD *)*v5 != v3) )
__fastfail(3u);
*v5 = v4;
*(_QWORD *)(v4 + 8) = v5;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&HandleTableListLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&HandleTableListLock);
KeAbPostRelease(&HandleTableListLock);
result = KeLeaveCriticalRegionThread((__int64)CurrentThread);
v3[1] = v3;
*v3 = v3;
return result;
}Referenced by:
AlpcpAllocateMessageFromExtendedTables
ObInitProcess
ObKillProcess
RtlDestroyAtomTable