KeQueryWakeSource

INT64 __fastcall KeQueryWakeSource(INT64 *a1, BYTE *a2){
  INT64 result; 
  unsigned __int8 CurrentIrql; 
  struct _KPRCB *CurrentPrcb; 
  _QWORD *v7; 
  __int64 v8; 
  _QWORD *v9; 
  __int64 v10; 
  __int64 v11; 
  UINT64 v12; 
  int v13; 
  unsigned int v14; 
  INT64 CurrentQpc; 
  BYTE v16; 
  BYTE v17; 
  v14 = 0;
  CurrentQpc = 0i64;
  v16 = 0;
  v17 = 0;
  memset((INT64)a2, 0i64);
  result = ((__int64(__fastcall *)(unsigned int *, _QWORD))off_140C008E8[0])(&v14, 0i64);
  if( (int)result >= 0 )
  {
    if( ((v14 - 209) & 0xFFFFFFFD) != 0 )
    {
      *(_DWORD *)a1 = 5;
      CurrentIrql = KeGetCurrentIrql();
      __writecr8(0xFui64);
      if( v14 <= 0xFF
        && (_mm_lfence(),
            CurrentPrcb = KeGetCurrentPrcb(),
            (v7 = (_QWORD *)*((_QWORD *)CurrentPrcb + v14 + 1576)) != 0i64) )
      {
        v8 = 0i64;
        v9 = (_QWORD *)*((_QWORD *)CurrentPrcb + v14 + 1576);
        do
        {
          v10 = v9[4];
          if( v10 || (v10 = v9[3]) != 0 )
            *(_QWORD *)&a2[8 * v8] = v10;
          v11 = v9[1];
          v8 = (unsigned int)(v8 + 1);
          if( !v11 )
            break;
          v9 = (_QWORD *)(v11 - 8);
          if( v9 == v7 )
            break;
        }
        while( (unsigned int)v8 < 3 );
      }
      else
      {
        *(_DWORD *)a1 = 2;
      }
      __writecr8(CurrentIrql);
    }
    else
    {
      LODWORD(v12) = RtlGetInterruptTimePrecise(&CurrentQpc);
      if( (unsigned int)KiGetPastDueIRTimerInfo(v12, &v16, &v17) )
      {
        v13 = 6;
        *a2 = v16;
        a2[2] = v17;
      }
      else
      {
        v13 = 1;
      }
      *(_DWORD *)a1 = v13;
    }
  }
  else
  {
    if( (_DWORD)result != -1073741823 )
      return result;
    *(_DWORD *)a1 = 0;
  }
  return 0i64;
}

Referenced by: