KiAbEntryRemoveFromTree

VOID __stdcall KiAbEntryRemoveFromTree(_KLOCK_ENTRY *Entry){
  __int64 v2; 
  INT64 *v3; 
  _RTL_RB_TREE *v4; 
  unsigned __int8 CurrentIrql; 
  int i; 
  _RTL_BALANCED_NODE *Min; 
  unsigned __int64 Root; 
  int v9; 
  unsigned __int64 v10; 
  unsigned int v11; 
  unsigned __int64 v12; 
  UINT64 *v13; 
  unsigned __int8 v14; 
  char *v15; 
  UINT64 v16; 
  __int64 v17; 
  unsigned __int64 v18; 
  unsigned int SessionId; 
  _KLOCK_QUEUE_HANDLE LockQueue; 
  _KLOCK_QUEUE_HANDLE v21; 

  SessionId = Entry->LockState.SessionId;
  v18 = Entry->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64;
  v2 = ((v18 >> 4) & 0x3FF) << 6;
  memset(&LockQueue, 0, sizeof(LockQueue));
  v3 = (INT64 *)((char *)&WheapErrorSourceTable + v2 + 3128);
  memset(&v21, 0, sizeof(v21));
  v4 = (_RTL_RB_TREE *)((char *)&WheapErrorSourceTable + v2 + 3112);
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  for( i = Entry->CrossThreadFlags & 1; ; i = 1 )
  {
    if( i )
      ExAcquireSpinLockExclusiveAtDpcLevel(v3);
    else
      ExAcquireSpinLockSharedAtDpcLevel((PEX_SPIN_LOCK)v3);
    Min = v4->Min;
    Root = (unsigned __int64)v4->Root;
    if( ((unsigned __int8)Min & 1) != 0 && Root )
      Root ^= (unsigned __int64)v4;
    v9 = (unsigned __int8)Min & 1;
    while( Root )
    {
      v10 = *(_QWORD *)(Root + 32) & 0x7FFFFFFFFFFFFFFCi64;
      if( v10 < v18 )
        goto LABEL_27;
      if( v10 > v18 )
        goto LABEL_12;
      v11 = *(_DWORD *)(Root + 40);
      if( v11 == SessionId )
        break;
      if( v11 < SessionId )
      {
LABEL_27:
        v12 = *(_QWORD *)(Root + 8);
        if( v9 && v12 )
        {
LABEL_31:
          Root ^= v12;
          continue;
        }
      }
      else
      {
LABEL_12:
        v12 = *(_QWORD *)Root;
        if( v9 && v12 )
          goto LABEL_31;
      }
      Root = v12;
    }
    LockQueue.LockQueue.Next = 0i64;
    LockQueue.LockQueue.Lock = (unsigned __int64 *volatile)(Root + 80);
    KxAcquireQueuedSpinLock(&LockQueue.LockQueue, (UINT64 *)(Root + 80));
    if( (_KLOCK_ENTRY *)Root != Entry )
      break;
    if( i )
    {
      if( *(_QWORD *)(Root + 64) )
      {
        v13 = (UINT64 *)(Root + 64);
      }
      else
      {
        v13 = (UINT64 *)(Root + 48);
        if( !*(_QWORD *)(Root + 48) )
          goto LABEL_19;
      }
      if( v13 )
      {
        v16 = *v13;
        RtlRbRemoveNode(v13, *v13);
        RtlRbReplaceNode(v4, (_RTL_BALANCED_NODE *)Root, (_RTL_BALANCED_NODE *)v16);
        v21.LockQueue.Next = 0i64;
        v21.LockQueue.Lock = (unsigned __int64 *volatile)(v16 + 80);
        KxAcquireQueuedSpinLock(&v21.LockQueue, (UINT64 *)(v16 + 80));
        ExReleaseSpinLockExclusiveFromDpcLevel(v3);
        *(_OWORD *)(v16 + 48) = *(_OWORD *)(Root + 48);
        *(_OWORD *)(v16 + 64) = *(_OWORD *)(Root + 64);
        *(_WORD *)(v16 + 90) ^= (*(_WORD *)(v16 + 90) ^ *(_WORD *)(Root + 90)) & 0x1FE;
        *(_WORD *)(v16 + 90) = *(_WORD *)(Root + 90) ^ (*(_WORD *)(v16 + 90) ^ *(_WORD *)(Root + 90)) & 0x1FF;
        KiAbTryDecrementIoWaiterCounts((_KLOCK_ENTRY *)Root, (_KLOCK_ENTRY *)v16);
        *(_BYTE *)(v16 + 27) |= 1u;
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&v21);
      }
      else
      {
LABEL_19:
        RtlRbRemoveNode((UINT64 *)v4, Root);
        ExReleaseSpinLockExclusiveFromDpcLevel(v3);
        v14 = *(_BYTE *)(Root + 27);
        if( (v14 & 2) != 0 )
        {
          *(_WORD *)(Root + 90) ^= (*(_WORD *)(Root + 90) ^ (2 * ((*(_WORD *)(Root + 90) >> 1) - 1))) & 0x1FE;
          *(_BYTE *)(Root + 27) &= ~2u;
          v14 = *(_BYTE *)(Root + 27);
        }
        if( (v14 & 4) != 0 )
        {
          *(_WORD *)(Root + 90) = *(_WORD *)(Root + 90) & 0x1FF | (((*(_WORD *)(Root + 90) >> 9) - 1) << 9);
          *(_BYTE *)(Root + 27) &= ~4u;
        }
      }
      *(_BYTE *)(Root + 39) &= ~0x80u;
      *(_BYTE *)(Root + 27) &= ~1u;
      goto LABEL_24;
    }
    ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v3);
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockQueue);
  }
  if( i )
    ExReleaseSpinLockExclusiveFromDpcLevel(v3);
  else
    ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v3);
  Entry->InTreeByte &= ~0x80u;
  if( (Entry->ThreadLocalFlags & 1) != 0 )
  {
    KiAbTryDecrementIoWaiterCounts(Entry, (_KLOCK_ENTRY *)Root);
    v17 = 64i64;
  }
  else
  {
    v17 = 48i64;
  }
  RtlRbRemoveNode((UINT64 *)(Root + v17), (UINT64)Entry);
LABEL_24:
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockQueue);
  v15 = (char *)Entry - 16 * Entry->EntryOffset;
  if( (Entry->ThreadLocalFlags & 1) != 0 )
    --v15[793];
  else
    _InterlockedExchangeAdd8(v15 + 871, 0xFFu);
  __writecr8(CurrentIrql);
}

Referenced by: