WheapApplyThresholdChecks

NTSTATUS __fastcall WheapApplyThresholdChecks(_WHEAP_ERROR_SOURCE *ErrorSource, _WHEA_ERROR_PACKET_V2 *ErrorPacket){
  unsigned __int64 v3; 
  char *v4; 
  unsigned int v5; 
  unsigned __int64 v6; 
  _LARGE_INTEGER TickCountQuad; 
  signed __int64 v8; 

  ++ErrorSource->TotalErrors;
  LODWORD(v3) = ErrorSource->Descriptor.Type;
  if( (_DWORD)v3 == 1 )
  {
    v3 = 144i64;
  }
  else
  {
    if( (_DWORD)v3 == 2 || (_DWORD)v3 == 4 || (_DWORD)v3 != 5 && (_DWORD)v3 != 8 && ((int)v3 <= 11 || (int)v3 > 13) )
      goto LABEL_22;
    v3 = 160i64;
  }
  v4 = (char *)ErrorSource + v3;
  if( (_WHEAP_ERROR_SOURCE *)((char *)ErrorSource + v3)
    && (*v4 == 1 || *v4 == 2 || *v4 == 3 || *v4 == 4 || *v4 == 8 || *v4 == 9 || *v4 == 10) )
  {
    v5 = *((_DWORD *)v4 + 5);
    v6 = *((unsigned int *)v4 + 6);
    if( v5 > 1 )
    {
      TickCountQuad = (_LARGE_INTEGER)KUSER_SHARED_DATA.TickCountQuad;
      if( (_DWORD)v6
        && (v8 = (unsigned int)KeMaximumIncrement
               * (KUSER_SHARED_DATA.TickCountQuad - ErrorSource->TickCountAtLastError.QuadPart),
            v3 = (unsigned __int64)(v8 + ((unsigned __int128)(v8 * (__int128)(__int64)0xD6BF94D5E57A42BDui64) >> 64)) >> 63,
            v8 / 10000000 > v6) )
      {
        ErrorSource->AccumulatedErrors = 1;
        ErrorSource->TickCountAtLastError = TickCountQuad;
      }
      else if( ++ErrorSource->AccumulatedErrors >= v5 )
      {
        ErrorSource->AccumulatedErrors = 0;
        LOBYTE(v3) = 1;
        return v3;
      }
    }
  }
LABEL_22:
  LOBYTE(v3) = 0;
  return v3;
}

Referenced by: