FsRtlFreeExtraCreateParameter
VOID __stdcall FsRtlFreeExtraCreateParameter(PVOID EcpContext){
void(__fastcall *v1)(PVOID, char *);
__int64 v2;
__int64 v4;
v1 = (void(__fastcall *)(PVOID, char *))*((_QWORD *)EcpContext - 4);
v2 = 0i64;
if( v1 )
v1(EcpContext, (char *)EcpContext - 48);
if( (*((_DWORD *)EcpContext - 6) & 0x20) != 0 && FltMgrCallbacks )
{
v2 = *((_QWORD *)EcpContext - 1);
(*(void(__fastcall **)(__int64, PVOID))FltMgrCallbacks)(v2, EcpContext);
}
v4 = *((_QWORD *)EcpContext - 2);
if( v4 )
{
if( (*((_DWORD *)EcpContext - 6) & 0x40) != 0 )
{
ExFreeToNPagedLookasideList((NPAGED_LOOKASIDE_LIST *)v4, (char *)EcpContext - 72);
}
else
{
++*(_DWORD *)(v4 + 28);
if( *(_WORD *)v4 >= *(_WORD *)(v4 + 16) )
{
++*(_DWORD *)(v4 + 32);
(*(void(__fastcall **)(char *))(v4 + 56))((char *)EcpContext - 72);
}
else
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v4, (PSLIST_ENTRY)((char *)EcpContext - 72));
}
}
}
else
{
ExFreePoolWithTag((char *)EcpContext - 72, 0);
}
if( v2 )
(*(void(__fastcall **)(__int64))(FltMgrCallbacks + 8))(v2);
}Referenced by:
FsRtlCheckOplockEx2
FsRtlpAttachOplockKey
FsRtlpCleanupEcps
IopCreateFile
IopDeleteFileObjectExtension
IopGraftName
IopSymlinkAllocateAndAddECP
IopSymlinkPropagateToExtensionIfNeeded
IopSymlinkUpdateECP
PspCreateUserProcessEcp