RtlFileMapFree
VOID __stdcall RtlFileMapFree(_RTL_FILE_MAP *FileMap){
VOID *v2;
__int64 v3;
VOID *v4;
if( FileMap )
{
v2 = (VOID *)*((_QWORD *)FileMap + 5);
if( v2 )
MmUnsecureVirtualMemory(v2);
if( *((_BYTE *)FileMap + 48) && *(_QWORD *)FileMap )
ZwClose(*(_QWORD *)FileMap);
if( *((_BYTE *)FileMap + 49) )
{
v3 = *((_QWORD *)FileMap + 1);
if( v3 )
ZwClose(v3);
}
if( *((_BYTE *)FileMap + 50) )
{
v4 = (VOID *)*((_QWORD *)FileMap + 3);
if( v4 )
ZwUnmapViewOfSection((VOID *)0xFFFFFFFFFFFFFFFFi64, v4);
}
*(_OWORD *)FileMap = 0i64;
*((_OWORD *)FileMap + 1) = 0i64;
*((_OWORD *)FileMap + 2) = 0i64;
*((_QWORD *)FileMap + 6) = 0i64;
}
}Referenced by:
AslFileMappingDelete
AslpFileGetChecksumAttributes
AslpFileGetVersionBlock