ExDereferenceHandleDebugInfo
VOID __stdcall ExDereferenceHandleDebugInfo(_HANDLE_TABLE *HandleTable, _HANDLE_TRACE_DEBUG_INFO *DebugInfo){
unsigned int TableSize;
_EPROCESS *QuotaProcess;
if( _InterlockedExchangeAdd(&DebugInfo->RefCount, 0xFFFFFFFF) == 1 )
{
TableSize = DebugInfo->TableSize;
ExFreePoolWithTag(DebugInfo, 0x6474624Fu);
QuotaProcess = HandleTable->QuotaProcess;
if( QuotaProcess )
PsReturnProcessNonPagedPoolQuota((ULONG_PTR)QuotaProcess, 160 * TableSize + 80);
_InterlockedExchangeAdd(&ExpTotalTraceBuffers, -TableSize);
}
}Referenced by:
ExDisableHandleTracing
ExEnableHandleTracing
ExpFreeHandleTable
ExpUpdateDebugInfo
NtQueryInformationProcess