NtUnmapViewOfSectionEx

NTSTATUS __stdcall NtUnmapViewOfSectionEx(PVOID ProcessHandle, PVOID BaseAddress, UINT64 Flags){
  char v3; 
  int v5; 
  KPROCESSOR_MODE v6; 
  NTSTATUS result; 
  NTSTATUS v8; 
  PVOID Object; 
  Object = 0i64;
  v3 = Flags;
  if( (Flags & 0xFFFFFFFC) != 0 )
    return -1073741583;
  v5 = (Flags & 2) << 25;
  v6 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v6 == 1 && (unsigned __int64)BaseAddress > 0x7FFFFFFEFFFFi64 )
    return -1073741799;
  result = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             8u,
             (POBJECT_TYPE)PsProcessType,
             v6,
             0x77566D4Du,
             &Object,
             0i64);
  if( result >= 0 )
  {
    v8 = MiUnmapViewOfSection((ULONG_PTR)Object, (unsigned __int64)BaseAddress, v3 & 1, v5);
    ObfDereferenceObjectWithTag(Object, 0x77566D4Dui64);
    return v8;
  }
  return result;
}

Referenced by: