MiDeleteAllHardwareEnclaves
NTSTATUS __stdcall MiDeleteAllHardwareEnclaves(){
_ETHREAD *CurrentThread;
__int64 v1;
_EPROCESS *v2;
UINT64 v3;
__int64 v4;
void *v5;
NTSTATUS result;
INT64 v7;
struct _KAPC_STATE ApcState;
memset(&ApcState, 0, sizeof(ApcState));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
ExWaitForRundownProtectionRelease((EX_RUNDOWN_REF *)&stru_140C4EC00);
--*((_WORD *)CurrentThread + 243);
while( 1 )
{
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4EBF8, 0i64);
v1 = qword_140C4EBE8;
if( (__int64 *)qword_140C4EBE8 == &qword_140C4EBE8 )
break;
v2 = *(_EPROCESS **)(qword_140C4EBE8 - 8);
ObfReferenceObject(v2);
v3 = (*(unsigned int *)(v1 - 96) | ((unsigned __int64)*(unsigned __int8 *)(v1 - 88) << 32)) << 12;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4EBF8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4EBF8);
KeAbPostRelease(&qword_140C4EBF8);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
KeStackAttachProcess((PRKPROCESS)v2, &ApcState);
v4 = MiObtainReferencedVadEx(v3, 0, &v7);
v5 = (void *)v4;
if( v4 )
{
if( (*(_DWORD *)(v4 + 48) & 0x3100000) == 34603008 && (*(_DWORD *)(v4 + 64) & 1) != 0 )
MiDeleteEnclavePages((__int64)v2, v4);
MiUnlockAndDereferenceVad(v5);
}
KeUnstackDetachProcess(&ApcState);
HalPutDmaAdapter((PADAPTER_OBJECT)v2);
--*((_WORD *)CurrentThread + 243);
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4EBF8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4EBF8);
KeAbPostRelease(&qword_140C4EBF8);
result = KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
if( qword_140C4EBC8 )
return KeRemoveEnclavePage((PVOID)qword_140C4EBC8);
return result;
}Referenced by:
MiShutdownSystem