IoDecrementKeepAliveCount

NTSTATUS __stdcall IoDecrementKeepAliveCount(_FILE_OBJECT *FileObject, _EPROCESS *Process){
  int v2; 
  NTSTATUS v3; 
  unsigned __int64 v4; 
  _IOP_KEEPALIVE_TRACKER *v5; 
  _IOP_KEEPALIVE_TRACKER **v6; 
  UINT64 v8; 
  _IOP_KEEPALIVE_TRACKER *v9; 

  LODWORD(v8) = 0;
  v9 = 0i64;
  IopAdjustFileObjectKeepAliveCount(FileObject, Process, 0i64, &v8, &v9);
  v3 = v2;
  if( v2 >= 0 && !(_DWORD)v8 )
  {
    v4 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)&stru_140C452E0 + 290);
    v5 = v9;
    *((_QWORD *)v9 + 6) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart + 50000000i64;
    --v5[8];
    if( *((_BYTE *)v5 + 16) )
    {
      if( *(&stru_140C452E0 + 296) )
        KeAlertThread(*(&stru_140C452E0 + 296), 0);
    }
    else
    {
      v6 = (_IOP_KEEPALIVE_TRACKER **)*(&stru_140C452E0 + 289);
      if( (_UNKNOWN *)**(&stru_140C452E0 + 289) != (_UNKNOWN *)((char *)&stru_140C452E0 + 2304) )
        __fastfail(3u);
      *(_QWORD *)v5 = (char *)&stru_140C452E0 + 2304;
      *((_QWORD *)v5 + 1) = v6;
      *v6 = v5;
      *(&stru_140C452E0 + 289) = v5;
      *((_BYTE *)v5 + 16) = 1;
      if( !*(&stru_140C452E0 + 2360) )
      {
        *(&stru_140C452E0 + 2360) = 1;
        ExQueueWorkItem((PWORK_QUEUE_ITEM)&stru_140C452E0 + 71, DelayedWorkQueue);
      }
    }
    KxReleaseSpinLock((UINT64 *)&stru_140C452E0 + 290);
    __writecr8(v4);
  }
  return v3;
}

Referenced by: