LdrUnloadAlternateResourceModuleEx
UINT8 __stdcall LdrUnloadAlternateResourceModuleEx(PVOID Module){
UINT8 v2;
int v3;
int v4;
char *v5;
char *v6;
void *v7;
int v8;
int v9;
UINT8 *PoolWithTag;
UINT8 *v11;
v2 = 0;
if( !Module )
return 0;
LdrpInitMuiCrits((INT64)Module);
KeWaitForSingleObject(&MuiMutex, Executive, 0, 0, 0i64);
v3 = AlternateResourceModuleCount;
if( (_DWORD)AlternateResourceModuleCount )
{
while( 1 )
{
if( v3 <= 0 )
goto LABEL_21;
v4 = v3 - 1;
v5 = (char *)AlternateResourceModules + 64 * (__int64)(v3 - 1);
if( *((PVOID *)v5 + 1) == Module )
break;
LABEL_5:
v3 = v4;
}
v6 = (char *)*((_QWORD *)v5 + 4);
if( (unsigned __int64)(v6 - 1) <= 0xFFFFFFFFFFFFFFFDui64 )
{
MmUnmapViewInSystemSpace(v6);
v7 = (void *)*((_QWORD *)v5 + 5);
if( v7 )
{
ZwClose(v7);
*((_QWORD *)v5 + 5) = 0i64;
}
*((_QWORD *)v5 + 4) = 0i64;
}
v8 = AlternateResourceModuleCount;
if( v3 != (_DWORD)AlternateResourceModuleCount )
memmove((UINT8 *)v5, (UINT8 *)v5 + 64, (unsigned __int64)(unsigned int)(AlternateResourceModuleCount - v3) << 6);
LODWORD(AlternateResourceModuleCount) = v8 - 1;
if( v8 == 1 )
{
ExFreePoolWithTag(AlternateResourceModules, 0);
AlternateResourceModules = 0i64;
v9 = 0;
}
else
{
if( v8 - 1 >= (unsigned int)(AltResMemBlockCount - 32) )
{
LABEL_20:
v2 = 1;
goto LABEL_5;
}
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(
PagedPool,
(unsigned __int64)(unsigned int)(AltResMemBlockCount - 32) << 6,
0x69507472ui64);
v11 = PoolWithTag;
if( !PoolWithTag )
{
v2 = 0;
goto LABEL_21;
}
memmove(
PoolWithTag,
(UINT8 *)AlternateResourceModules,
(unsigned __int64)(unsigned int)(AltResMemBlockCount - 32) << 6);
ExFreePoolWithTag(AlternateResourceModules, 0);
AlternateResourceModules = v11;
v9 = AltResMemBlockCount - 32;
}
AltResMemBlockCount = v9;
goto LABEL_20;
}
v2 = 1;
LABEL_21:
KeReleaseMutant(&MuiMutex, 1, 0, 0);
return v2;
}Referenced by:
LdrUnloadAlternateResourceModule
LdrpGetFromMUIMemCache