ExIsResourceAcquiredSharedLite
NTSTATUS __fastcall ExIsResourceAcquiredSharedLite(UINT64 a1, INT64 a2, INT64 a3){
__int16 v4;
NTSTATUS v5;
_ETHREAD *CurrentThread;
__int64 SpareByte0;
unsigned __int8 v9;
__int64 v10;
unsigned int v11;
int v12;
bool v13;
unsigned int v14;
unsigned __int8 CurrentIrql;
_KLOCK_QUEUE_HANDLE LockQueue;
v4 = *(_WORD *)(a1 + 26);
if( (v4 & 0x41) == 1 )
KeBugCheckEx(0x1C6u, (PVOID)0xF, (PVOID)a1, 0i64, 0i64);
if( (v4 & 1) != 0 )
{
CurrentIrql = KeGetCurrentIrql();
if( CurrentIrql > 2u )
KeBugCheckEx(0x1C6u, 0i64, (PVOID)CurrentIrql, (PVOID)2, 0i64);
}
if( (v4 & 1) == 0 )
{
memset(&LockQueue, 0, sizeof(LockQueue));
if( !*(_DWORD *)(a1 + 64) )
return 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( *(_ETHREAD **)(a1 + 48) == CurrentThread )
return *(_DWORD *)(a1 + 56) >> 3;
v5 = 0;
if( (v4 & 0x80u) != 0 )
return v5;
SpareByte0 = CurrentThread->Tcb.SchedulerApc.SpareByte0;
LockQueue.LockQueue.Lock = (unsigned __int64 *volatile)(a1 + 96);
LockQueue.LockQueue.Next = 0i64;
v9 = KeGetCurrentIrql();
__writecr8(2ui64);
LockQueue.OldIrql = v9;
KxAcquireQueuedSpinLock(&LockQueue.LockQueue, (UINT64 *)(a1 + 96));
v10 = *(_QWORD *)(a1 + 16);
if( v10 )
{
v11 = *(_DWORD *)(v10 + 8);
if( (unsigned int)SpareByte0 < v11 && *(_ETHREAD **)(v10 + 16 * SpareByte0) == CurrentThread )
{
v14 = *(_DWORD *)(v10 + 16 * SpareByte0 + 8);
LABEL_19:
v5 = v14 >> 3;
goto LABEL_17;
}
v12 = 1;
if( v11 > 1 )
{
while( 1 )
{
v13 = *(_QWORD *)(v10 + 16) == (_QWORD)CurrentThread;
v10 += 16i64;
if( v13 )
break;
if( ++v12 >= v11 )
goto LABEL_17;
}
v14 = *(_DWORD *)(v10 + 8);
goto LABEL_19;
}
}
LABEL_17:
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockQueue);
__writecr8(LockQueue.OldIrql);
return v5;
}
return ExpFastResourceLegacyIsAcquiredShared(a1);
}Referenced by:
CmLoadDifferencingKey
CmPostCallbackNotification
CmPostCallbackNotificationEx
CmUnloadKey
CmpDeleteKeyObject
CmpDoQueryKeyName
CmpDoReOpenTransKey
CmpParseKey
CmpSecurityMethod
FsRtlAcquireFileForCcFlushEx
NtDeleteKey
NtDeleteValueKey
NtEnumerateKey
NtEnumerateValueKey
NtFlushKey
NtQueryKey
NtQueryMultipleValueKey
NtQueryValueKey
NtRenameKey
NtReplaceKey
NtRestoreKey
NtSaveKeyEx
NtSetInformationKey
NtSetValueKey
PpDevNodeLockTree