NtWaitForSingleObject
NTSTATUS __fastcall NtWaitForSingleObject(UINT64 a1, INT8 a2, UINT64 a3){
char PreviousMode;
UINT64 Timeout;
_LARGE_INTEGER v7;
v7.QuadPart = 0i64;
PreviousMode = KeGetCurrentThread()->PreviousMode;
Timeout = a3;
if( a3 && PreviousMode )
{
if( a3 >= 0x7FFFFFFF0000i64 )
Timeout = 0x7FFFFFFF0000i64;
v7 = *(_LARGE_INTEGER *)Timeout;
Timeout = (UINT64)&v7;
}
return ObWaitForSingleObject((VOID *)a1, PreviousMode, PreviousMode, a2, (_LARGE_INTEGER *)Timeout);
}Referenced by:
PfSnPrefetchFileMetadata
SepRmCallLsa