KiRemoveTimer2

VOID __stdcall KiRemoveTimer2(_KTIMER2 *Timer){
  unsigned __int8 *CollectionIndex; 
  unsigned int v3; 
  int v4; 
  __int64 v5; 
  __int64 v6; 
  unsigned __int8 v7; 
  unsigned __int64 *v8; 
  __int64 v9; 
  _KTIMER2 *v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  __int64 *v14; 
  __int64 v15; 
  unsigned __int64 v16; 
  bool v17; 
  volatile signed __int32 *v18; 
  CollectionIndex = Timer->CollectionIndex;
  v3 = 0;
  v4 = 0;
  v5 = 0i64;
  v6 = 72i64;
  do
  {
    v7 = *CollectionIndex;
    if( (*CollectionIndex & 0x10) == 0 )
    {
      v8 = (unsigned __int64 *)(0x140000000i64 + 24i64 * (v7 & 7) + 12786240);
      v9 = *(_QWORD *)(0x140000008i64 + 24i64 * (v7 & 7) + 12786240);
      if( (v9 & 1) != 0 )
        v10 = v9 == 1 ? 0i64 : (_KTIMER2 *)(v9 ^ ((unsigned __int64)v8 | 1));
      else
        v10 = *(_KTIMER2 **)(0x140000008i64 + 24i64 * (v7 & 7) + 12786240);
      RtlRbRemoveNode(v8, (unsigned __int64)Timer->RbNodes[v3].Children);
      if( v10 == (_KTIMER2 *)&Timer->RbNodes[v3] )
      {
        v11 = v8[1];
        v4 = 1;
        if( (v11 & 1) != 0 )
        {
          if( v11 == 1 )
          {
LABEL_28:
            v8[2] = -1i64;
            goto LABEL_10;
          }
          v12 = v11 ^ ((unsigned __int64)v8 | 1);
        }
        else
        {
          v12 = v8[1];
        }
        if( v12 )
        {
          v8[2] = *(_QWORD *)(v6 - v5 + v12 - 24);
          goto LABEL_10;
        }
        goto LABEL_28;
      }
    }
LABEL_10:
    ++v3;
    v6 += 8i64;
    ++CollectionIndex;
    v5 += 24i64;
  }
  while( v3 < 2 );
  if( v4 && KiNextTimer2DueTime == Timer->DueTime[0] )
  {
    v13 = -1i64;
    v14 = qword_140C31A50;
    v15 = 5i64;
    do
    {
      v16 = v13;
      v13 = *v14;
      v17 = *v14 < v16;
      v14 += 3;
      if( !v17 )
        v13 = v16;
      --v15;
    }
    while( v15 );
    KiNextTimer2DueTime = v13;
  }
  if( (Timer->TypeFlags & 4) != 0 && _InterlockedExchangeAdd(&KiHrTimerActiveCount, 0xFFFFFFFF) == 1 )
  {
    v18 = (volatile signed __int32 *)*((_QWORD *)*(&KiProcessorBlock + (unsigned int)KiClockTimerOwner) + 4247);
    if( v18 )
    {
      if( (KiVelocityFlags & 0x40) != 0 )
        _InterlockedAnd(v18, 0xFFF7FFFF);
    }
  }
}

Referenced by:

KeCancelTimer2
KeDisableTimer2
KeSetTimer2
KiAdjustTimer2DueTimes
KiInsertTimer2WithCollectionLockHeld
KiTimer2Expiration