ExSaFree

VOID __stdcall ExSaFree(VOID *Handle){
  unsigned int v1; 
  _EXP_SA_HANDLE v2; 
  __int64 v3; 
  __int64 v4; 
  unsigned int v5; 
  _ETHREAD *CurrentThread; 
  __int64 v7; 
  __int64 v8; 

  v2 = (int)Handle;
  v3 = v1;
  v4 = ((unsigned int)Handle >> 13) & 0x3FFFF;
  _BitScanReverse(&v5, v4);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v7 = *(_QWORD *)(*(_QWORD *)(*(&WheapDeferredInternalLogsEventLock + 51) + 8i64 * (v5 - 2))
                 + 8 * (v4 ^ (unsigned int)(1 << v5))
                 + 8);
  v8 = *(_QWORD *)(v7 + 16);
  --CurrentThread->Tcb.SpecialApcDisable;
  ExpSaAllocatorFree(v8, (_EX_SA_PAGE_GROUP_DESCRIPTOR *)v7, v2, (unsigned __int64)(v3 + 7) >> 3);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}

Referenced by: