KeSuspendClockTimerSafe
INT64 __stdcall KeSuspendClockTimerSafe(){
unsigned __int8 CurrentIrql;
struct _KPRCB *v1;
int v2;
INT64 result;
struct _KPRCB *CurrentPrcb;
int v5;
if( ObGetCurrentIrql() >= 0xDu )
{
CurrentPrcb = KeGetCurrentPrcb();
result = (unsigned int)KiClockState;
v5 = KiClockTimerOwner;
if( (*((_BYTE *)CurrentPrcb + 34) & 1) != 0 )
{
result = off_140C00888[0]();
*((_BYTE *)CurrentPrcb + 34) &= ~1u;
}
if( *((_DWORD *)CurrentPrcb + 9) == v5 )
++dword_140C31348;
if( *((_BYTE *)CurrentPrcb + 33) )
*((_BYTE *)CurrentPrcb + 33) = 0;
}
else
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(0xDui64);
v1 = KeGetCurrentPrcb();
v2 = KiClockTimerOwner;
if( (*((_BYTE *)v1 + 34) & 1) != 0 )
{
off_140C00888[0]();
*((_BYTE *)v1 + 34) &= ~1u;
}
if( *((_DWORD *)v1 + 9) == v2 )
++dword_140C31348;
if( *((_BYTE *)v1 + 33) )
*((_BYTE *)v1 + 33) = 0;
result = CurrentIrql;
__writecr8(CurrentIrql);
}
return result;
}Referenced by:
IopLiveDumpProcessCorralStateChange
PnprQuiesceProcessorDpc
PnprQuiesceProcessors