KeReleaseSemaphoreEx

INT64 __stdcall KeReleaseSemaphoreEx(KSEMAPHORE *Semaphore, INT64 BoostIncrement, INT64 Adjustment, UINT64 Flags){
  int v4; 
  unsigned int v5; 
  UINT8 OldIrql; 
  struct _KPRCB *CurrentPrcb; 
  int SignalState; 
  int v10; 
  unsigned int v11; 
  KSEMAPHORE *Flink; 
  __int64 v13; 
  _KWAIT_BLOCK *v14; 
  _LIST_ENTRY *Blink; 
  unsigned __int8 WaitType; 
  bool v17; 
  _LIST_ENTRY *v19; 
  _KQUEUE *v20; 
  UINT8 v21; 
  int v22; 
  _LIST_ENTRY *v23; 
  _KPRCB *Prcb; 
  __int64 v25; 
  _LIST_ENTRY *p_WaitListHead; 
  unsigned int v27; 
  _KQUEUE *Object; 
  char v29; 
  v27 = BoostIncrement;
  v4 = Adjustment;
  v5 = BoostIncrement;
  OldIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  CurrentPrcb = KeGetCurrentPrcb();
  KiAcquireKobjectLockSafe(Semaphore);
  SignalState = Semaphore->Header.SignalState;
  v10 = SignalState + v4;
  if( SignalState + v4 > Semaphore->Limit || v10 < SignalState )
  {
    _InterlockedAnd(&Semaphore->Header.Lock, 0xFFFFFF7F);
    __writecr8(OldIrql);
    RtlRaiseStatus(-1073741753);
  }
  v11 = 0;
  Semaphore->Header.SignalState = v10;
  if( !SignalState )
  {
    Flink = (KSEMAPHORE *)Semaphore->Header.WaitListHead.Flink;
    while( Flink != (KSEMAPHORE *)&Semaphore->Header.WaitListHead )
    {
      v13 = *(_QWORD *)&Flink->Header.Lock;
      v14 = (_KWAIT_BLOCK *)Flink;
      Flink = (KSEMAPHORE *)v13;
      Blink = v14->WaitListEntry.Blink;
      if( *(_KWAIT_BLOCK **)(v13 + 8) != v14 || (_KWAIT_BLOCK *)Blink->Flink != v14 )
LABEL_6:
        __fastfail(3u);
      Blink->Flink = (_LIST_ENTRY *)v13;
      *(_QWORD *)(v13 + 8) = Blink;
      WaitType = v14->WaitType;
      if( WaitType == 1 )
      {
        if( KiTryUnwaitThread(CurrentPrcb, v14, v14->WaitKey, 0i64) )
        {
          v17 = Semaphore->Header.SignalState-- == 1;
          if( v17 )
            break;
        }
      }
      else
      {
        if( WaitType == 2 )
        {
          v14->BlockState = 5;
          Object = v14->NotificationQueue;
          p_WaitListHead = &Object->Header.WaitListHead;
          v14->WaitListEntry.Flink = 0i64;
          KeGetCurrentIrql();
          __writecr8(2ui64);
          Prcb = KeGetCurrentPrcb();
          v25 = *((_QWORD *)Prcb + 1);
          KiAcquireKobjectLockSafe(Object);
          v19 = p_WaitListHead;
          v20 = Object;
          if( v19->Flink == v19
            || Object->CurrentCount >= Object->MaximumCount
            || *(_KQUEUE **)(v25 + 232) == Object && *(_BYTE *)(v25 + 643) == 15 )
          {
LABEL_28:
            v22 = v20->Header.SignalState;
            v20->Header.SignalState = v22 + 1;
            v23 = v20->EntryListHead.Blink;
            if( v23->Flink != &v20->EntryListHead )
              goto LABEL_6;
            v14->WaitListEntry.Flink = &v20->EntryListHead;
            v14->WaitListEntry.Blink = v23;
            v23->Flink = &v14->WaitListEntry;
            v20->EntryListHead.Blink = &v14->WaitListEntry;
            if( !v22 && v19->Flink != v19 )
            {
              KiWakeOtherQueueWaiters(Prcb, v20);
              v20 = Object;
            }
          }
          else
          {
            v21 = KiWakeQueueWaiter(Prcb, Object, (INT64)v14);
            v20 = Object;
            if( !v21 )
            {
              v19 = &Object->Header.WaitListHead;
              goto LABEL_28;
            }
          }
          _InterlockedAnd(&v20->Header.Lock, 0xFFFFFF7F);
          v17 = Semaphore->Header.SignalState-- == 1;
          if( v17 )
            break;
          continue;
        }
        KiTryUnwaitThread(CurrentPrcb, v14, 256i64, 0i64);
      }
    }
    v5 = v27;
  }
  _InterlockedAnd(&Semaphore->Header.Lock, 0xFFFFFF7F);
  if( (v29 & 1) != 0 )
  {
    v11 = 1;
    if( (v29 & 4) == 0 )
      v11 = 3;
  }
  else if( (v29 & 2) != 0 )
  {
    KiCompleteDirectSwitchThread((__int64)CurrentPrcb, *((_QWORD *)CurrentPrcb + 1));
  }
  KiExitDispatcher(CurrentPrcb, v11, AdjustUnwait, v5, OldIrql);
  return(unsigned int)SignalState;
}

Referenced by: