KiCheckDueTimeExpired
_BOOL8 __fastcall KiCheckDueTimeExpired(__int64 a1, int a2, unsigned __int64 a3){
unsigned __int64 v3;
__int64 v4;
if( a2 == 2 )
{
v3 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart
- *(_QWORD *)(a1 + 248)
- KUSER_SHARED_DATA.InterruptTimeBias;
v4 = *(unsigned int *)(a1 + 952);
if( *(_BYTE *)(a1 + 391) && !*(_DWORD *)(a1 + 484) && !*(_BYTE *)(a1 + 390) && !*(_BYTE *)(a1 + 192) )
{
if( (_DWORD)v4 )
a3 += v4;
}
return v3 > a3;
}
if( !a2 )
return 0i64;
if( a3 )
{
v3 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
return v3 > a3;
}
return 1i64;
}Referenced by:
KeDelayExecutionThread
KeWaitForAlertByThreadId
KiWaitForAllObjects