SeClearLearningModeObjectInformation
VOID __stdcall SeClearLearningModeObjectInformation(){
_ETHREAD *CurrentThread;
int v1;
__int64 v2;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( KeGetCurrentIrql() )
v1 = 2;
else
v1 = (*((_BYTE *)KeGetCurrentThread() + 192) & 1) != 0;
v2 = *((_QWORD *)CurrentThread + 181);
if( v2 )
{
if( *(_DWORD *)(v2 + 8) == v1 )
{
*((_QWORD *)CurrentThread + 181) = *(_QWORD *)v2;
if( *(_QWORD *)(v2 + 32) )
{
if( *(_QWORD *)(v2 + 48) )
RtlFreeAnsiString((_UNICODE_STRING *)(v2 + 40));
}
}
}
}Referenced by:
ObOpenObjectByNameEx
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpLookupObjectName
RtlpAllowsLowBoxAccess