ExpDeleteTimer

VOID __fastcall ExpDeleteTimer(VOID *Object){
  _QWORD *v1; 
  unsigned __int64 v3; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v5; 
  __int64 v6; 
  unsigned int v7; 
  __int64 AbOrphanedEntrySummary; 
  char v9; 
  __int64 v10; 
  NTSTATUS SessionId; 
  bool v12; 
  __int64 v13; 
  _QWORD *v14; 
  _ETHREAD *v15; 
  unsigned __int8 v16; 
  int v17; 
  __int64 v18; 
  _KLOCK_ENTRY *v19; 
  int v20; 
  unsigned int v21; 
  unsigned __int8 v22; 
  _DIAGNOSTIC_CONTEXT *Context; 
  UINT64 v24; 
  int v25; 
  UINT64 a3; 

  v1 = (char *)Object + 264;
  if( !*((_QWORD *)Object + 33) )
    goto LABEL_2;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Context = (_DIAGNOSTIC_CONTEXT *)*((_QWORD *)Object + 32);
  --CurrentThread->Tcb.KernelApcDisable;
  v5 = (_ETHREAD *)KeGetCurrentThread();
  LODWORD(a3) = 0;
  --v5->Tcb.SpecialApcDisable;
  if( ++v5->Tcb.AbAllocationRegionCount != 1 )
    KeBugCheckEx(0x192u, v5, (char *)&WheapDeferredInternalLogsEventLock + 2912, (PVOID)KeGetCurrentIrql(), 0i64);
  LOBYTE(v6) = v5->Tcb.AbEntrySummary;
  v7 = -1;
  v25 = 0;
  if( !(_BYTE)v6 )
  {
    if( !v5->Tcb.AbOrphanedEntrySummary )
    {
      v10 = 0i64;
      goto LABEL_16;
    }
    AbOrphanedEntrySummary = v5->Tcb.AbOrphanedEntrySummary;
    v5->Tcb.AbOrphanedEntrySummary = 0;
    LOBYTE(v6) = AbOrphanedEntrySummary | v5->Tcb.AbEntrySummary;
  }
  v9 = v6;
  _BitScanForward((unsigned int *)&v6, (unsigned __int8)v6);
  v25 = v6;
  v5->Tcb.AbEntrySummary = v9 & ~(1 << v6);
  v10 = (__int64)&v5->Tcb.LockEntries[v6];
  if( !v10 )
  {
LABEL_16:
    _interlockedbittestandset((volatile signed __int32 *)&v5->Tcb.116 + 1, 0x10u);
    goto LABEL_19;
  }
  if( (unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912 >= 0xFFFF800000000000ui64
    && *((_BYTE *)&stru_140C4DB30
       + ((((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) >> 39) & 0x1FF)
       + 6872) == 1 )
  {
    SessionId = MmGetSessionIdEx(v5->Tcb.ApcState.Process);
  }
  else
  {
    SessionId = -1;
  }
  *(_DWORD *)(v10 + 40) = SessionId;
  *(_QWORD *)(v10 + 32) = ((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) & 0x7FFFFFFFFFFFFFFCi64;
LABEL_19:
  --v5->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&v5->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, &a3);
  v12 = v5->Tcb.SpecialApcDisable++ == -1;
  if( v12 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v5->Tcb.ApcState.ApcListHead[0].Flink != &v5->Tcb.152 )
    KiCheckForKernelApcDelivery();
  if( _interlockedbittestandset64((volatile signed __int32 *)&WheapDeferredInternalLogsEventLock + 728, 0i64) )
    ExfAcquirePushLockExclusiveEx(
      (_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364,
      (VOID *)v10,
      (char *)&WheapDeferredInternalLogsEventLock + 2912);
  if( v10 )
    *(_BYTE *)(v10 + 26) |= 1u;
  v13 = *v1;
  v14 = (_QWORD *)v1[1];
  if( *(_QWORD **)(*v1 + 8i64) != v1 || (_QWORD *)*v14 != v1 )
    __fastfail(3u);
  *v14 = v13;
  *(_QWORD *)(v13 + 8) = v14;
  *v1 = 0i64;
  if( (_InterlockedExchangeAdd64((_QWORD *)&WheapDeferredInternalLogsEventLock + 364, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364);
  LODWORD(v24) = 0;
  v15 = (_ETHREAD *)KeGetCurrentThread();
  if( MiGetSystemRegionType((UINT64)&WheapDeferredInternalLogsEventLock + 2912) == 1 )
    v7 = MmGetSessionIdEx(v15->Tcb.ApcState.Process);
  --v15->Tcb.SpecialApcDisable;
  v16 = ++v15->Tcb.AbAllocationRegionCount;
  v17 = ((char)v15->Tcb.AbEntrySummary | (char)v15->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
  while( 1 )
  {
    v12 = !_BitScanReverse((unsigned int *)&v18, v17);
    if( v12 )
      break;
    v19 = &v15->Tcb.LockEntries[v18];
    v17 &= ~(1 << v18);
    if( (v19->AcquiredByte & 1) != 0
      && (v19->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
      && (v19->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (((unsigned __int64)&WheapDeferredInternalLogsEventLock
                                                                                              + 2912) & 0x7FFFFFFFFFFFFFFCi64)
      && v19->LockState.SessionId == v7 )
    {
      v19->AcquiredByte &= ~1u;
      if( v19->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
      {
        if( v19 )
        {
          v19->CrossThreadReleasableAndBusyByte |= 2u;
          if( v19->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
            KiAbEntryRemoveFromTree(v19);
          v20 = v19->BoostBitmap.AllFields & 0x1FFFF;
          v21 = v19->BoostBitmap.AllFields & 0xFFFE0000;
          v19->ThreadLocalFlags &= ~1u;
          LODWORD(v24) = v20;
          v19->BoostBitmap.AllFields = v21;
          v19->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
          v22 = 1 << ((char)((_BYTE)v19 - LOBYTE(v15->Tcb.LockEntries)) / 96);
          if( v16 == 1 )
            v15->Tcb.AbEntrySummary |= v22;
          else
            _InterlockedOr8((volatile signed __int8 *)&v15->Tcb.AbOrphanedEntrySummary, v22);
          goto LABEL_44;
        }
        break;
      }
    }
  }
  if( (*(&v15->Tcb.MiscFlags + 1) & 0x10000) == 0 )
    KeBugCheckEx(0x162u, v15, (char *)&WheapDeferredInternalLogsEventLock + 2912, (PVOID)v7, 0i64);
LABEL_44:
  --v15->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&v15->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, &v24);
  v12 = v15->Tcb.SpecialApcDisable++ == -1;
  if( v12 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v15->Tcb.ApcState.ApcListHead[0].Flink != &v15->Tcb.152 )
    KiCheckForKernelApcDelivery();
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  if( Context )
    PoDestroyReasonContext(Context);
LABEL_2:
  v3 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)Object + 8);
  if( *((_QWORD *)Object + 35) )
  {
    PsRemoveVirtualizedTimer((char *)Object + 280, (_LIST_ENTRY *)Object + 18);
  }
  else
  {
    KxReleaseSpinLock((UINT64 *)Object + 8);
    __writecr8(v3);
  }
  KeCancelTimer((INT64)Object);
}

Referenced by: