ObpDeregisterObject
void __fastcall ObpDeregisterObject(_OBJECT_HEADER *ObjectHeader){
_ETHREAD *CurrentThread;
_QWORD *v3;
__int64 v4;
_QWORD *v5;
__int64 v6;
if( (xmmword_140CFB490 & 0x80u) != 0i64 )
EtwTraceObject(0x1131u, (INT64)ObjectHeader);
if( (ObjectHeader->TraceFlags & 3) == 1 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = 0i64;
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx((UINT64)&ObpStackTraceLock, 0i64);
if( (ObpTraceFlags & 0x73) == 0 )
goto LABEL_15;
v4 = (((unsigned int)((_DWORD)ObjectHeader + 48) >> 4) & 0xFFFFF) % 0x191;
v5 = (_QWORD *)*((_QWORD *)ObpObjectTable + v4);
if( !v5 )
goto LABEL_15;
do
{
if( (_OBJECT_HEADER *)*v5 == ObjectHeader )
break;
v3 = v5;
v5 = (_QWORD *)v5[1];
}
while( v5 );
if( v5 )
{
v6 = v5[1];
if( v3 )
v3[1] = v6;
else
*((_QWORD *)ObpObjectTable + v4) = v6;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&ObpStackTraceLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&ObpStackTraceLock);
KeAbPostRelease(&ObpStackTraceLock);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
ExFreePoolWithTag(v5, 0x7452624Fu);
}
else
{
LABEL_15:
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&ObpStackTraceLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&ObpStackTraceLock);
KeAbPostRelease(&ObpStackTraceLock);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
}
}Referenced by:
ObfDereferenceObjectWithTag
ObpProcessRemoveObjectQueue