ExRecordOneTimerExpiry
CHAR __stdcall ExRecordOneTimerExpiry(UINT8 a1, CHAR a2){
__int64 v2;
unsigned __int8 v3;
__int64 *v4;
int v5;
__int64 v6;
__int64 v7;
if( *(&ExBootDevicesRemovedEvent + 18) )
{
v2 = a1 < 0x10u ? a1 : 0;
v3 = a1 < 0x10u ? a2 : 0;
v4 = qword_1400022D0;
LOBYTE(v5) = v3 < LOBYTE(qword_1400022D0[3 * v2]) ? v3 : 0;
v6 = (unsigned __int8)v5;
if( ((unsigned __int8)v2 & (unsigned __int8)-(v3 < LOBYTE(qword_1400022D0[3 * v2]))) != 0 )
{
v7 = v3 < LOBYTE(qword_1400022D0[3 * v2]) ? (unsigned __int8)v2 : 0;
do
{
v5 = *(unsigned __int8 *)v4;
v4 += 3;
v6 = (unsigned int)(v5 + v6);
--v7;
}
while( v7 );
}
++*(_DWORD *)(*(&ExBootDevicesRemovedEvent + 18) + 4 * v6);
}
return v5;
}Referenced by:
KeResumeClockTimerFromIdle