SeClearLearningModeObjectInformation
VOID __stdcall SeClearLearningModeObjectInformation(){
_ETHREAD *CurrentThread;
int v1;
_SINGLE_LIST_ENTRY *Next;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( KeGetCurrentIrql() )
v1 = 2;
else
v1 = (KeGetCurrentThread()->ApcState.InProgressFlags & 1) != 0;
Next = CurrentThread->SeLearningModeListHead.Next;
if( Next )
{
if( LODWORD(Next[1].Next) == v1 )
{
CurrentThread->SeLearningModeListHead = (_SINGLE_LIST_ENTRY)Next->Next;
if( Next[4].Next )
{
if( Next[6].Next )
RtlFreeAnsiString((_UNICODE_STRING *)&Next[5]);
}
}
}
}Referenced by:
ObOpenObjectByNameEx
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpLookupObjectName
RtlpAllowsLowBoxAccess