WbFreeMemoryBlock
NTSTATUS __stdcall WbFreeMemoryBlock(PVOID *BaseAddress){
int v2;
MDL *v3;
NTSTATUS result;
PVOID v5;
if( BaseAddress )
{
if( BaseAddress[2] == *((PVOID *)KeGetCurrentThread() + 23) )
{
v5 = BaseAddress[135];
v2 = 1;
if( v5 )
MmUnsecureVirtualMemory(v5);
}
else
{
v2 = 0;
}
v3 = (MDL *)BaseAddress[3];
if( v3 )
{
sub_14064F46C(v3);
BaseAddress[3] = 0i64;
}
BaseAddress[4] = 0i64;
if( *BaseAddress )
{
if( v2 )
ZwFreeVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, BaseAddress, (UINT64 *)BaseAddress + 1, 0x8000ui64);
*BaseAddress = 0i64;
BaseAddress[1] = 0i64;
}
ExFreePoolWithTag(BaseAddress, 0x42524157u);
}
return result;
}Referenced by:
WbAllocateMemoryBlock
WbAllocateUserMemory
WbFreeWarbirdProcess