NtCancelTimer
NTSTATUS __stdcall NtCancelTimer(VOID *TimerHandle, UINT8 *CurrentState){
char PreviousMode;
int v5;
_OBJECT_HEADER *v6;
_OBJECT_TYPE *v7;
UINT64 *v8;
_ETIMER *v9;
_DIAGNOSTIC_CONTEXT *Flink;
unsigned int v11;
int v12;
void *v13;
_ETHREAD *v15;
__int64 v16;
char v17;
__int64 v18;
NTSTATUS SessionId;
__int64 v20;
bool v21;
_QWORD *v22;
__int64 v23;
_QWORD *v24;
char v25;
unsigned int v26;
_ETHREAD *v27;
_KLOCK_ENTRY *v28;
int v29;
__int64 v30;
__int64 v31;
_KLOCK_ENTRY_BOOST_BITMAP v32;
unsigned __int8 v33;
__int64 v34;
__int64 AbOrphanedEntrySummary;
unsigned __int8 Thread;
_ETHREAD *Threada;
PVOID BugCheckParameter2;
_ETHREAD *v39;
int v40;
UINT64 a3;
_KTHREAD *CurrentThread;
_DIAGNOSTIC_CONTEXT *v43;
unsigned __int64 v44;
char LockHandle;
_BYTE *LockHandlea;
unsigned __int8 LockHandleb;
UINT64 v48;
PreviousMode = KeGetCurrentThread()->PreviousMode;
if( CurrentState && PreviousMode )
{
v34 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)CurrentState < 0x7FFFFFFF0000i64 )
v34 = (__int64)CurrentState;
*(_BYTE *)v34 = *(_BYTE *)v34;
}
BugCheckParameter2 = 0i64;
v5 = ObReferenceObjectByHandle(TimerHandle, 2ui64, 0i64, PreviousMode, &BugCheckParameter2, 0i64);
HIDWORD(a3) = v5;
if( v5 < 0 )
return v5;
v6 = (_OBJECT_HEADER *)((char *)BugCheckParameter2 - 48);
v7 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)BugCheckParameter2
- 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)BugCheckParameter2 - 48) >> 8)];
if( v7 == ExpIRTimerObjectType )
{
if( CurrentState )
{
ObfDereferenceObjectWithTag(BugCheckParameter2, 0x746C6644ui64);
return -1073741811;
}
else
{
return ExpSetTimerObject2(BugCheckParameter2);
}
}
else
{
if( v7 == ExTimerObjectType )
{
CurrentThread = 0i64;
LockHandle = 0;
v8 = (UINT64 *)((char *)BugCheckParameter2 + 64);
Thread = KeGetCurrentIrql();
__writecr8(2ui64);
if( _interlockedbittestandset64((volatile signed __int32 *)v8, 0i64) )
KxWaitForSpinLockAndAcquire(v8);
v9 = (_ETIMER *)BugCheckParameter2;
Flink = (_DIAGNOSTIC_CONTEXT *)*((_QWORD *)BugCheckParameter2 + 32);
v43 = Flink;
if( !Flink )
goto LABEL_8;
KxReleaseSpinLock(v8);
__writecr8(Thread);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
LODWORD(a3) = 0;
v15 = (_ETHREAD *)KeGetCurrentThread();
v39 = v15;
--v15->Tcb.SpecialApcDisable;
if( ++v15->Tcb.AbAllocationRegionCount != 1 )
KeBugCheckEx(0x192u, v15, (char *)&WheapDeferredInternalLogsEventLock + 2912, (PVOID)KeGetCurrentIrql(), 0i64);
v40 = 0;
LOBYTE(v16) = v15->Tcb.AbEntrySummary;
if( !(_BYTE)v16 )
{
if( !v15->Tcb.AbOrphanedEntrySummary )
{
v18 = 0i64;
LockHandlea = 0i64;
goto LABEL_20;
}
AbOrphanedEntrySummary = v15->Tcb.AbOrphanedEntrySummary;
v15->Tcb.AbOrphanedEntrySummary = 0;
LOBYTE(v16) = AbOrphanedEntrySummary | v15->Tcb.AbEntrySummary;
}
v17 = v16;
_BitScanForward((unsigned int *)&v16, (unsigned __int8)v16);
v40 = v16;
v15->Tcb.AbEntrySummary = v17 & ~(1 << v16);
v18 = (__int64)&v15->Tcb.LockEntries[v16];
LockHandlea = (_BYTE *)v18;
LABEL_20:
if( v18 )
{
if( (unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912 >= 0xFFFF800000000000ui64
&& *((_BYTE *)&stru_140C4DB30
+ ((((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) >> 39) & 0x1FF)
+ 6872) == 1 )
{
SessionId = MmGetSessionIdEx(v15->Tcb.ApcState.Process);
v15 = v39;
v18 = (__int64)LockHandlea;
}
else
{
SessionId = -1;
}
*(_DWORD *)(v18 + 40) = SessionId;
*(_QWORD *)(v18 + 32) = ((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) & 0x7FFFFFFFFFFFFFFCi64;
}
else
{
_interlockedbittestandset((volatile signed __int32 *)&v15->Tcb.116 + 1, 0x10u);
}
--v15->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v15->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, &a3);
v20 = (__int64)v39;
v21 = v39->Tcb.SpecialApcDisable++ == -1;
if( v21 && *(_QWORD *)(v20 + 152) != v20 + 152 )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)&WheapDeferredInternalLogsEventLock + 728, 0i64) )
ExfAcquirePushLockExclusiveEx(
(_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364,
LockHandlea,
(char *)&WheapDeferredInternalLogsEventLock + 2912);
if( LockHandlea )
LockHandlea[26] |= 1u;
LockHandle = 1;
Thread = KeAcquireSpinLockRaiseToDpc(v8);
Flink = (_DIAGNOSTIC_CONTEXT *)v9->WakeTimerListEntry.Flink;
v43 = Flink;
v9->WakeTimerListEntry.Flink = 0i64;
v9 = (_ETIMER *)BugCheckParameter2;
LABEL_8:
v11 = ExpCancelTimer(v9) + 1;
_InterlockedAnd64((volatile signed __int64 *)v8, 0i64);
__writecr8(Thread);
if( LockHandle )
{
if( Flink )
{
v22 = (char *)BugCheckParameter2 + 264;
v23 = *((_QWORD *)BugCheckParameter2 + 33);
v24 = (_QWORD *)*((_QWORD *)BugCheckParameter2 + 34);
if( *(PVOID *)(v23 + 8) != (char *)BugCheckParameter2 + 264 || (_QWORD *)*v24 != v22 )
__fastfail(3u);
*v24 = v23;
*(_QWORD *)(v23 + 8) = v24;
*v22 = 0i64;
}
v25 = _InterlockedExchangeAdd64((_QWORD *)&WheapDeferredInternalLogsEventLock + 364, 0xFFFFFFFFFFFFFFFFui64);
if( (v25 & 2) != 0 && (v25 & 4) == 0 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364);
LODWORD(v48) = 0;
Threada = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&WheapDeferredInternalLogsEventLock + 2912) == 1 )
v26 = MmGetSessionIdEx(Threada->Tcb.ApcState.Process);
else
v26 = -1;
v27 = Threada;
--Threada->Tcb.SpecialApcDisable;
LockHandleb = ++Threada->Tcb.AbAllocationRegionCount;
v28 = 0i64;
v39 = 0i64;
v44 = ((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) & 0x7FFFFFFFFFFFFFFCi64;
v29 = ((char)Threada->Tcb.AbEntrySummary | (char)Threada->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v21 = !_BitScanReverse((unsigned int *)&v30, v29);
if( !v21 )
{
while( 1 )
{
v29 &= ~(1 << v30);
v31 = (__int64)&Threada->Tcb.LockEntries[v30];
if( (*(_BYTE *)(v31 + 26) & 1) != 0
&& (*(_DWORD *)(v31 + 32) & 1) == 0
&& (*(_QWORD *)(v31 + 32) & 0x7FFFFFFFFFFFFFFCi64) == v44
&& *(_DWORD *)(v31 + 40) == v26 )
{
*(_BYTE *)(v31 + 26) &= ~1u;
if( *(_QWORD *)(v31 + 32) )
break;
}
v21 = !_BitScanReverse((unsigned int *)&v30, v29);
if( v21 )
goto LABEL_47;
}
v28 = (_KLOCK_ENTRY *)v31;
v39 = (_ETHREAD *)v31;
}
LABEL_47:
if( v28 )
{
v28->CrossThreadReleasableAndBusyByte |= 2u;
if( v28->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
{
KiAbEntryRemoveFromTree(v28);
v27 = Threada;
v28 = (_KLOCK_ENTRY *)v39;
}
v32.AllFields = (unsigned int)v28->BoostBitmap;
LODWORD(v48) = v32.AllFields & 0x1FFFF;
v28->BoostBitmap.AllFields = v32.AllFields & 0xFFFE0000;
v28->ThreadLocalFlags &= ~1u;
v28->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v33 = 1 << (v28 - v27->Tcb.LockEntries);
if( LockHandleb == 1 )
v27->Tcb.AbEntrySummary |= v33;
else
_InterlockedOr8((volatile signed __int8 *)&v27->Tcb.AbOrphanedEntrySummary, v33);
}
else if( (*(&Threada->Tcb.MiscFlags + 1) & 0x10000) == 0 )
{
KeBugCheckEx(0x162u, Threada, (char *)&WheapDeferredInternalLogsEventLock + 2912, (PVOID)v26, 0i64);
}
--v27->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v27->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, &v48);
v21 = Threada->Tcb.SpecialApcDisable++ == -1;
if( v21 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)Threada->Tcb.ApcState.ApcListHead[0].Flink != &Threada->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
}
v12 = *((_DWORD *)BugCheckParameter2 + 1);
if( ObpTraceFlags )
ObpPushStackInfo(v6, 0, v11, 0x746C6644ui64);
v13 = (void *)(_InterlockedExchangeAdd64(&v6->PointerCount, -v11) - (int)v11);
if( (__int64)v13 <= 0 )
{
if( v6->HandleCount )
KeBugCheckEx(
0x18u,
(PVOID)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v6->TypeIndex ^ (unsigned __int64)BYTE1(v6)],
BugCheckParameter2,
(PVOID)6,
v6->NextToFree);
if( (__int64)v13 < 0 )
KeBugCheckEx(0x18u, 0i64, BugCheckParameter2, (PVOID)5, v13);
ObpDeferObjectDeletion(v6);
}
if( CurrentState )
*CurrentState = v12;
if( Flink )
PoDestroyReasonContext(Flink);
return v5;
}
ObfDereferenceObjectWithTag(BugCheckParameter2, 0x746C6644ui64);
return -1073741788;
}
}Referenced by:
No references.