DbgkpCloseObject

VOID __stdcall DbgkpCloseObject(_EPROCESS *Process, VOID *Object, UINT64 ProcessHandleCount, UINT64 SystemHandleCount){
  _DEBUG_EVENT *v5; 
  int v6; 
  _EPROCESS *NextProcess; 
  char v8; 
  _DEBUG_EVENT *v9; 

  if( SystemHandleCount <= 1 )
  {
    ExAcquireFastMutex((PFAST_MUTEX)((char *)Object + 24));
    *((_DWORD *)Object + 24) |= 1u;
    v5 = (_DEBUG_EVENT *)*((_QWORD *)Object + 10);
    *((_QWORD *)Object + 10) = (char *)Object + 80;
    *((_QWORD *)Object + 11) = (char *)Object + 80;
    KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)Object + 24));
    KeSetEvent((PRKEVENT)Object, 0, 0);
    v6 = *((_DWORD *)Object + 24) & 2;
    NextProcess = (_EPROCESS *)PsGetNextProcess(0i64);
    if( NextProcess )
    {
      v8 = v6 != 0 ? 2 : 0;
      do
      {
        if( NextProcess->DebugPort == Object )
        {
          v8 &= ~1u;
          ExAcquireFastMutex(&DbgkpProcessDebugPortMutex);
          if( NextProcess->DebugPort == Object )
          {
            NextProcess->DebugPort = 0i64;
            v8 |= 1u;
          }
          KeReleaseGuardedMutex(&DbgkpProcessDebugPortMutex);
          if( (v8 & 1) != 0 )
          {
            DbgkpMarkProcessPeb(NextProcess);
            if( (v8 & 2) != 0 )
              PsTerminateProcess((ULONG_PTR)NextProcess, 0xC0000354ui64);
            HalPutDmaAdapter((PADAPTER_OBJECT)Object);
          }
        }
        NextProcess = (_EPROCESS *)PsGetNextProcess(NextProcess);
      }
      while( NextProcess );
    }
    while( v5 != (_DEBUG_EVENT *)((char *)Object + 80) )
    {
      v9 = v5;
      v5 = *(_DEBUG_EVENT **)v5;
      v9[18] = -1073740972;
      DbgkpWakeTarget(v9);
    }
  }
}

Referenced by:

No references.