( (--((PHEAD) pobj)->cLockObj == 0) ? HMUnlockObjectInternal (pobj) : pobj )

PVOID HMUnlockObjectInternal (
    PVOID pobj)
{
    PHE phe;

    //如果handle entry没有被标记上HANDLEF_DESTROY则返回
    phe = HMPheFromObject(pobj);
    if (!(phe->bFlags & HANDLEF_DESTROY))
        return pobj;

    //如果该对象正在destroy的过程中同样返回
    if (phe->bFlags & HANDLEF_INDESTROY)
        return pobj;

    HMDestroyUnlockedObject(phe);
    return NULL;
}

VOID HMDestroyUnlockedObject (
    PHE phe)
{
    //把对象标记为正在destroy的过程中
    phe->bFlags |= HANDLEF_INDESTROY;

    //调用destroy函数
    (*gahti[phe->bType].fnDestroy)(phe->phead);
}

VOID xxxFreeWindow (
    PWND pwnd,
    PTL  ptlpwndFree)
{
//...
    /*
     * Try to free the object. The object won't free if it is locked - but
     * it will be marked for destruction. If the window is locked, change
     * it's wndproc to xxxDefWindowProc().
     *
     * HMMarkObjectDestroy() will clear the HANDLEF_INDESTROY flag if the
     * object isn't about to go away (so it can be destroyed again!)
     */
    if (HMMarkObjectDestroy(pwnd)) {

        /*
         * Delete the window's property list. Wait until now in case some
         * thread keeps a property pointer around across a callback.
         */
        if (pwnd->ppropList != NULL) {
            DeleteProperties(pwnd);
        }

        pti->cWindows--;

        /*
         * Since we're freeing the memory for this window, we need
         * to unlock the parent (which is the desktop for zombie windows).
         */
        Unlock(&pwnd->spwndParent);

        ThreadLockDesktop(pti, pwnd->head.rpdesk, &tlpdesk, LDLT_FN_FREEWINDOW);
        HMFreeObject(pwnd);
        ThreadUnlockDesktop(pti, &tlpdesk, LDUT_FN_FREEWINDOW);
        return;
    }

    /*
     * Turn this into an object that the app won't see again - turn
     * it into an icon title window - the window is still totally
     * valid and useable by any structures that has this window locked.
     */
    pwnd->lpfnWndProc = xxxDefWindowProc;
    //...
}

void KeUserModeCallback ( IN ULONG ApiNumber, IN PVOID InputBuffer, IN ULONG InputLength, OUT PVOID *OutputBuffer, IN PULONG OutputLength )

#define _GETPTI(p)      (((PTHROBJHEAD)p)->pti)
#define GETPTI(p)       _GETPTI(p)
#define PWNDTOPSBTRACK(pwnd) (((GETPTI(pwnd)->pSBTrack)))
void xxxSBTrackInit(
    PWND pwnd,
    LPARAM lParam,
    int curArea,
    UINT uType)
{
//...
PWNDTOPSBTRACK(pwnd) = pSBTrack;
//...
}
void xxxEndScroll(
    PWND pwnd,
    BOOL fCancel)
{
    UINT oldcmd;
    PSBTRACK pSBTrack;
    CheckLock(pwnd);
    UserAssert(!IsWinEventNotifyDeferred());

    pSBTrack = PWNDTOPSBTRACK(pwnd);
//...
}

void xxxEndScroll (
    PWND pwnd,
    BOOL fCancel)
{
//...
    Unlock(&pSBTrack->spwndSB);
    Unlock(&pSBTrack->spwndSBNotify);
    Unlock(&pSBTrack->spwndTrack);
    UserFreePool(pSBTrack);
    PWNDTOPSBTRACK(pwnd) = NULL;
}   
void xxxSBTrackInit(
    PWND pwnd,
    LPARAM lParam,
    int curArea,
    UINT uType)
{
//...
 if (pSBTrack->fCtlSB) {
        /*
         * This is a scroll bar control.
         */
        Lock(&pSBTrack->spwndSB, pwnd);
        pSBTrack->fTrackVert = ((PSBWND)pwnd)->fVert;
        Lock(&pSBTrack->spwndSBNotify, pwnd->spwndParent);
        wDisable = ((PSBWND)pwnd)->wDisableFlags;
        pSBCalc = &((PSBWND)pwnd)->SBCalc;
        pSBTrack->nBar = SB_CTL;
    } else {
    //...
    }  
//...
 xxxSBTrackLoop(pwnd, lParam, pSBCalc);

      // After xxx, re-evaluate pSBTrack
    REEVALUATE_PSBTRACK(pSBTrack, pwnd, "xxxTrackLoop");
    if (pSBTrack) {
        Unlock(&pSBTrack->spwndSBNotify);
        Unlock(&pSBTrack->spwndSB);
        Unlock(&pSBTrack->spwndTrack);
        UserFreePool(pSBTrack); 
        PWNDTOPSBTRACK(pwnd) = NULL;
    }
}

//xxxFreewindow部分代码
//调用xxxClientAllocWindowClassExtraBytes的逻辑
  v19 = *((_QWORD *)a1 + 5);
  v20 = *(_QWORD *)(v19 + 0x128);
  if ( v20 && v20 != -1 )
  {
    if ( (*(_DWORD *)(v19 + 0xE8) & 0x800) != 0 )
    {
      RtlFreeHeap(*(PVOID *)(*((_QWORD *)a1 + 3) + 128i64), 0, (PVOID)(v20 + *(_QWORD *)(*((_QWORD *)a1 + 3) + 128i64)));
      *(_QWORD *)(*((_QWORD *)a1 + 5) + 0x128i64) = 0i64;
    }
    else
    {
      *(_QWORD *)(v19 + 0x128) = 0i64;
      if ( (*(_DWORD *)(PsGetCurrentProcess(v19, v18, v16, v17) + 0x304) & 0x40000008) == 0
        && (*(_DWORD *)(gptiCurrent + 480i64) & 1) == 0 )
      {
        xxxClientFreeWindowClassExtraBytes(a1, v20);
      }
    }
  }
//调用fnDWORD的逻辑
 v15 = *((_QWORD *)a1 + 5);
  v18 = 0x3FFFi64;
  v16 = *(unsigned __int16 *)(v15 + 42); //v16 是fnid
  v17 = 672i64;
  LOWORD(v18) = v16 & 0x3FFF;
  if ( ((unsigned __int16)v16 & 0x3FFFu) >= 0x29A && (v16 & 0x4000) == 0 )
  {
    if ( (unsigned __int16)v18 <= 0x2A0u )
    {
      ((void (__fastcall *)(struct tagWND *, __int64, _QWORD))mpFnidPfn[((_BYTE)v16 + 6) & 0x1F])(a1, 112i64, 0i64);
    }
    else if ( (unsigned __int16)v18 <= 0x2AAu && (*(_DWORD *)(gptiCurrent + 480i64) & 1) == 0 )
    //pti+480 是 TIF_flags
    {
      SfnDWORD((unsigned int)a1, 112u, 0i64, 0i64, 0i64, *(_QWORD *)(gpsi + 8i64 * (unsigned __int16)v18 - 4608));
    }
    *(_WORD *)(*((_QWORD *)a1 + 5) + 42i64) |= 0x4000u;
    v15 = *((_QWORD *)a1 + 5);
  }

 LOWORD(v18) = v16 & 0x3FFF;
  if ( ((unsigned __int16)v16 & 0x3FFFu) >= 0x29A && (v16 & 0x4000) == 0 )
  {
    if ( (unsigned __int16) v18 <= 0x2A0u )
    {
      ((void (__fastcall *)(struct tagWND *, __int64, _QWORD)) mpFnidPfn[((_BYTE) v16 + 6) & 0x1F])(a1, 0x70i64, 0i64);
    }
    else if ( (unsigned __int16) v18 <= 0x2AAu && (*(_DWORD *)(gptiCurrent + 0x1E0i64) & 1) == 0 )
    {
      SfnDWORD ((unsigned int) a1, 0x70u, 0i64, 0i64, 0i64, *(_QWORD *)(gpsi + 8i64 * (unsigned __int16) v18 - 0x1200));
    }
    *(_WORD *)(*((_QWORD *)a1 + 5) + 0x2Ai64) |= 0x4000u;
    v15 = *((_QWORD *)a1 + 5);
  }

    REEVALUATE_PSBTRACK (pSBTrack, pwnd, "xxxTrackLoop");
    if (pSBTrack) {
        void* spwndSBNotify, spwndSB, spwndTrack;
        spwndSBNotify = pSBTrack->spwndSBNotify;
        spwndSB = pSBTrack->spwndSB;
        spwndTrack = pSBTrack->spwndTrack;
        UserFreePool(pSBTrack);
        PWNDTOPSBTRACK(pwnd) = NULL;
        Unlock(&spwndSBNotify);
        Unlock(&spwndSB);
        Unlock(&spwndTrack);
    }