ExpSetTimerObject
NTSTATUS __stdcall ExpSetTimerObject(
UINT64 P2,
CHAR a2,
INT64 *r8_0,
INT32 *a4,
INT64 a5,
INT64 a6,
CHAR a7,
UINT64 a8,
UINT64 a9,
_BYTE *a10){
CHAR v10;
char v12;
_EPROCESS *Process;
char v14;
int v15;
unsigned __int8 v16;
unsigned int v17;
INT64 v18;
unsigned int v19;
unsigned int v20;
unsigned int v21;
__int64 *v22;
__int64 v23;
UINT64 *v24;
char v25;
__int64 v26;
__int64 v27;
struct _KPRCB *CurrentPrcb;
_EPROCESS *v29;
char v30;
__int16 v31;
char v32;
__int64 v33;
__int64 v34;
VOID *v35;
_DIAGNOSTIC_CONTEXT *v36;
struct _KPRCB *v37;
void *v38;
_BYTE *v39;
__int64 v41;
volatile signed __int32 *v42;
_KTIMER_TABLE *v43;
unsigned __int64 v44;
signed __int64 v45;
unsigned int v46;
__int64 v47;
_ETHREAD *v48;
UINT64 *p_ActiveTimerListLock;
_LIST_ENTRY *v50;
_LIST_ENTRY *p_ActiveTimerListHead;
_LIST_ENTRY *Blink;
unsigned __int64 v53;
_ETHREAD *CurrentThread;
__int64 v55;
char v56;
__int64 v57;
NTSTATUS SessionId;
bool v59;
_QWORD *v60;
_QWORD *v61;
char v62;
_ETHREAD *v63;
__int64 v64;
unsigned __int8 v65;
_KLOCK_ENTRY *v66;
int v67;
__int64 v68;
__int64 v69;
_KLOCK_ENTRY_BOOST_BITMAP v70;
unsigned __int8 v71;
NTSTATUS v72;
__int64 AbOrphanedEntrySummary;
_ETHREAD *v74;
__int64 v75;
__int64 v76;
char v77;
__int64 v78;
NTSTATUS v79;
unsigned __int8 v80;
__int64 v81;
__int64 v82;
_QWORD *v83;
char v84;
unsigned int v85;
__int64 v86;
volatile signed __int64 *v87;
_QWORD *v88;
__int64 v89;
_QWORD *v90;
__int64 v91;
char v93;
char v94;
int v95;
NTSTATUS v96;
char v97;
UINT64 *Object;
unsigned __int8 CurrentIrql;
INT64 v100;
_KTIMER_TABLE *p_TimerTable;
UINT64 v102;
int v103;
char v104[12];
VOID *v105;
_KTIMER_TABLE *TimerTable;
int v107;
char v108[12];
UINT64 Hand;
int v110;
UINT64 a3;
volatile signed __int32 *v112;
UINT64 v113;
volatile signed __int64 *v114;
_KDPC *Dpc;
_KTHREAD *Thread;
UINT64 SpinCount;
__int128 v118;
__int64 v119;
__int64 v120;
__int64 v121;
__int64 v122;
struct _KPRCB *v123;
__int64 v124;
_BYTE *v125;
__int128 v126;
__int64 v127;
*(_QWORD *)&v104[4] = a4;
Hand = (UINT64)r8_0;
v10 = a2;
v125 = a10;
v96 = 0;
v12 = 0;
v94 = 0;
Thread = 0i64;
v105 = (VOID *)a6;
if( !a6 )
goto LABEL_2;
if( a7 )
{
if( !ExpCheckTestsigningEnabled() )
{
v72 = ExpCheckWakeTimerAccess(KeGetCurrentThread()->PreviousMode);
v96 = v72;
if( v72 )
{
ObfDereferenceObjectWithTag((VOID *)P2, 0x746C6644ui64);
return v72;
}
}
v10 = a2;
}
if( *(&stru_140C23628 + 534) < 2 && !*(&stru_140C23628 + 2091) )
{
v96 = 1073741861;
v105 = 0i64;
goto LABEL_2;
}
v12 = 1;
v94 = 1;
Thread = (_ETHREAD *)KeGetCurrentThread();
--Thread->Tcb.KernelApcDisable;
LODWORD(a3) = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.SpecialApcDisable;
if( ++CurrentThread->Tcb.AbAllocationRegionCount != 1 )
KeBugCheckEx(
0x192u,
CurrentThread,
(char *)&WheapDeferredInternalLogsEventLock + 2912,
(PVOID)KeGetCurrentIrql(),
0i64);
v110 = 0;
LOBYTE(v55) = CurrentThread->Tcb.AbEntrySummary;
if( !(_BYTE)v55 )
{
if( !CurrentThread->Tcb.AbOrphanedEntrySummary )
{
v57 = 0i64;
goto LABEL_79;
}
AbOrphanedEntrySummary = CurrentThread->Tcb.AbOrphanedEntrySummary;
CurrentThread->Tcb.AbOrphanedEntrySummary = 0;
LOBYTE(v55) = AbOrphanedEntrySummary | CurrentThread->Tcb.AbEntrySummary;
}
v56 = v55;
_BitScanForward((unsigned int *)&v55, (unsigned __int8)v55);
v110 = v55;
CurrentThread->Tcb.AbEntrySummary = v56 & ~(1 << v55);
v57 = (__int64)&CurrentThread->Tcb.LockEntries[v55];
LABEL_79:
if( v57 )
{
if( (unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912 >= 0xFFFF800000000000ui64
&& *((_BYTE *)&stru_140C4DB30
+ ((((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) >> 39) & 0x1FF)
+ 6872) == 1 )
{
SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
}
else
{
SessionId = -1;
}
*(_DWORD *)(v57 + 40) = SessionId;
*(_QWORD *)(v57 + 32) = ((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) & 0x7FFFFFFFFFFFFFFCi64;
}
else
{
_interlockedbittestandset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 0x10u);
}
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, &a3);
v59 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v59
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
if( _interlockedbittestandset64((volatile signed __int32 *)&WheapDeferredInternalLogsEventLock + 728, 0i64) )
ExfAcquirePushLockExclusiveEx(
(_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364,
(VOID *)v57,
(char *)&WheapDeferredInternalLogsEventLock + 2912);
v10 = a2;
if( v57 )
*(_BYTE *)(v57 + 26) |= 1u;
LABEL_2:
Dpc = 0i64;
Process = KeGetCurrentThread()->ApcState.Process;
Object = (UINT64 *)Process;
v14 = 0;
v93 = 0;
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
if( v10 && (Process->Pcb._bf_0 & 0x10) != 0 )
{
KxAcquireSpinLock(&Process->VirtualTimerListLock);
v14 = 1;
v93 = 1;
}
if( _interlockedbittestandset64((volatile signed __int32 *)(P2 + 64), 0i64) )
KxWaitForSpinLockAndAcquire((UINT64 *)(P2 + 64));
if( !v12 && *(_QWORD *)(P2 + 256) )
{
KxReleaseSpinLock((UINT64 *)(P2 + 64));
if( v14 )
KxReleaseSpinLock(&Process->VirtualTimerListLock);
__writecr8(CurrentIrql);
v94 = 1;
Thread = (_ETHREAD *)KeGetCurrentThread();
--Thread->Tcb.KernelApcDisable;
LODWORD(v113) = 0;
v74 = (_ETHREAD *)KeGetCurrentThread();
--v74->Tcb.SpecialApcDisable;
if( ++v74->Tcb.AbAllocationRegionCount != 1 )
KeBugCheckEx(0x192u, v74, (char *)&WheapDeferredInternalLogsEventLock + 2912, (PVOID)KeGetCurrentIrql(), 0i64);
HIDWORD(a3) = 0;
LOBYTE(v75) = v74->Tcb.AbEntrySummary;
if( !(_BYTE)v75 )
{
if( !v74->Tcb.AbOrphanedEntrySummary )
{
v78 = 0i64;
goto LABEL_147;
}
v76 = v74->Tcb.AbOrphanedEntrySummary;
v74->Tcb.AbOrphanedEntrySummary = 0;
LOBYTE(v75) = v76 | v74->Tcb.AbEntrySummary;
}
v77 = v75;
_BitScanForward((unsigned int *)&v75, (unsigned __int8)v75);
HIDWORD(a3) = v75;
v74->Tcb.AbEntrySummary = v77 & ~(1 << v75);
v78 = (__int64)&v74->Tcb.LockEntries[v75];
LABEL_147:
if( v78 )
{
if( (unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912 >= 0xFFFF800000000000ui64
&& *((_BYTE *)&stru_140C4DB30
+ ((((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) >> 39) & 0x1FF)
+ 6872) == 1 )
{
v79 = MmGetSessionIdEx(v74->Tcb.ApcState.Process);
}
else
{
v79 = -1;
}
*(_DWORD *)(v78 + 40) = v79;
*(_QWORD *)(v78 + 32) = ((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) & 0x7FFFFFFFFFFFFFFCi64;
}
else
{
_interlockedbittestandset((volatile signed __int32 *)&v74->Tcb.116 + 1, 0x10u);
}
--v74->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v74->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, &v113);
v59 = v74->Tcb.SpecialApcDisable++ == -1;
if( v59 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v74->Tcb.ApcState.ApcListHead[0].Flink != &v74->Tcb.152 )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)&WheapDeferredInternalLogsEventLock + 728, 0i64) )
ExfAcquirePushLockExclusiveEx(
(_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364,
(VOID *)v78,
(char *)&WheapDeferredInternalLogsEventLock + 2912);
if( v78 )
*(_BYTE *)(v78 + 26) |= 1u;
v80 = KeGetCurrentIrql();
__writecr8(2ui64);
CurrentIrql = v80;
if( v93 )
KxAcquireSpinLock(Object + 305);
KxAcquireSpinLock((UINT64 *)(P2 + 64));
}
v15 = 0;
if( (*(_BYTE *)(P2 + 304) & 1) != 0 )
{
v81 = *(_QWORD *)(P2 + 80);
KxAcquireSpinLock((UINT64 *)(v81 + 1120));
v82 = *(_QWORD *)(P2 + 224);
v83 = *(_QWORD **)(P2 + 232);
if( *(_QWORD *)(v82 + 8) != P2 + 224 || *v83 != P2 + 224 )
goto LABEL_222;
*v83 = v82;
*(_QWORD *)(v82 + 8) = v83;
KxReleaseSpinLock((UINT64 *)(v81 + 1120));
*(_BYTE *)(P2 + 304) &= ~1u;
if( (*(_BYTE *)(P2 + 304) & 2) != 0 && *(_BYTE *)(P2 + 248)
|| (unsigned __int8)KeCancelTimer(P2)
|| (KeRemoveQueueDpcEx((_KDPC *)(P2 + 160), 0i64), v84) )
{
v15 = 1;
}
v18 = P2 + 72;
if( KeRemoveQueueApc(P2 + 72) )
++v15;
}
else
{
v16 = KeGetCurrentIrql();
__writecr8(2ui64);
v120 = 0i64;
v112 = 0i64;
LODWORD(v102) = 0;
while( 1 )
{
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset((volatile signed __int32 *)P2, 7u) )
{
do
KeYieldProcessorEx(&SpinCount);
while( (*(_DWORD *)P2 & 0x80u) != 0 );
}
if( (*(_BYTE *)(P2 + 3) & 0xC0) == 0 )
{
v17 = -129;
goto LABEL_14;
}
v41 = *(unsigned __int8 *)(P2 + 2);
TimerTable = &(*(&KiProcessorBlock + *(unsigned __int16 *)(P2 + 56)))->TimerTable;
v42 = (volatile signed __int32 *)&TimerTable->TimerEntries[(unsigned __int64)*(unsigned __int16 *)(P2 + 58)][v41];
HIDWORD(SpinCount) = 0;
while( _interlockedbittestandset64(v42, 0i64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( *(_QWORD *)v42 );
}
v112 = v42;
v43 = TimerTable;
if( *(char *)(P2 + 3) >= 0 )
{
KiRemoveEntryTimer(TimerTable, (_KTIMER *)P2, (unsigned int)v41);
_InterlockedAnd64((volatile signed __int64 *)v112, 0i64);
v17 = -1073741953;
goto LABEL_14;
}
_InterlockedAnd64((volatile signed __int64 *)v42, 0i64);
if( _InterlockedExchange64((volatile __int64 *)&v43->TimerExpiry[*(_BYTE *)(P2 + 3) & 0x3F], 0i64) )
break;
_InterlockedAnd((volatile signed __int32 *)P2, 0xFFFFFF7F);
LODWORD(v102) = 0;
while( *(char *)(P2 + 3) < 0 )
KeYieldProcessorEx(&v102);
}
v17 = 16777087;
LABEL_14:
_InterlockedAnd((volatile signed __int32 *)P2, v17);
__writecr8(v16);
v18 = P2 + 72;
v15 = 0;
}
*(_BYTE *)(P2 + 248) = 0;
v19 = v15 + 1;
v20 = *(_DWORD *)(P2 + 4);
v97 = v20;
v21 = a8;
v95 = a8;
*(_DWORD *)(P2 + 240) = a8;
*(_DWORD *)(P2 + 244) = 0;
*(_DWORD *)(P2 + 320) = a9;
if( *(_QWORD *)&v104[4] )
{
v48 = (_ETHREAD *)KeGetCurrentThread();
KeInitializeApc(v18, (INT64)v48, 2i64, (INT64)ExpTimerApcRoutine, 0i64, *(INT64 *)&v104[4], a2, a5);
p_ActiveTimerListLock = &v48->ActiveTimerListLock;
KxAcquireSpinLock(&v48->ActiveTimerListLock);
v50 = (_LIST_ENTRY *)(P2 + 224);
p_ActiveTimerListHead = &v48->ActiveTimerListHead;
Blink = p_ActiveTimerListHead->Blink;
if( Blink->Flink != p_ActiveTimerListHead )
goto LABEL_222;
v50->Flink = p_ActiveTimerListHead;
*(_QWORD *)(P2 + 232) = Blink;
Blink->Flink = v50;
p_ActiveTimerListHead->Blink = v50;
*(_BYTE *)(P2 + 304) |= 1u;
KxReleaseSpinLock(p_ActiveTimerListLock);
Dpc = (_KDPC *)(P2 + 160);
v19 = v15;
v21 = 0;
v95 = 0;
}
v22 = (__int64 *)Hand;
v23 = *(_QWORD *)Hand;
v100 = *(_QWORD *)Hand;
v24 = Object;
v25 = v93;
if( v93 )
{
if( !*(_QWORD *)(P2 + 280) )
{
PsInsertVirtualizedTimer(Object, P2 + 280);
v21 = v95;
v24 = Object;
}
_InterlockedIncrement((volatile signed __int32 *)v24 + 606);
v20 = *((_DWORD *)v24 + 158);
if( (v20 & 0x10) != 0 )
{
v47 = *((unsigned int *)v24 + 17);
if( (_DWORD)v47 )
{
v107 = *((_DWORD *)v24 + 17);
v23 = *v22;
if( *v22 >= 0 )
{
if( (unsigned __int64)v23 <= *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart )
v23 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
v23 += v47;
if( v23 < *v22 )
v23 = *v22;
LODWORD(v47) = v107;
}
else if( v23 - v47 <= v23 )
{
v23 -= v47;
}
HIDWORD(v100) = HIDWORD(v23);
v85 = (unsigned int)v47 / 0x2710;
if( v21 )
{
v20 = v85 + v21;
if( v85 + v21 > v21 )
{
v21 += v85;
v95 = v20;
*(_DWORD *)(P2 + 240) += v85;
LABEL_194:
*(_DWORD *)(P2 + 244) = v85;
goto LABEL_17;
}
}
v20 = *(_DWORD *)(P2 + 240);
if( v20 && v20 + v85 > v20 )
{
*(_DWORD *)(P2 + 240) = v20 + v85;
goto LABEL_194;
}
}
}
}
LABEL_17:
if( (*(_BYTE *)(P2 + 304) & 2) != 0 )
{
*(_QWORD *)(P2 + 312) = v23;
v35 = v105;
if( v100 < 0 )
{
LOBYTE(v20) = (v105 != 0i64) + 2;
*(_BYTE *)(P2 + 248) = v20;
}
else
{
*(_BYTE *)(P2 + 248) = 1;
}
goto LABEL_35;
}
v26 = v23;
v126 = 0i64;
v127 = 0i64;
if( (_DWORD)a9 )
{
v44 = 10000i64 * (unsigned int)a9;
if( v44 > 0xFC0000 )
{
v45 = v44 - 16515072;
if( v23 >= 0 )
{
v23 += v45;
if( v23 < v26 )
v23 = 0x7FFFFFFFFFFFFFFFi64;
}
else
{
v23 -= v45;
if( v23 > v26 )
v23 = 0x8000000000000000ui64;
}
if( v21 )
{
v53 = (__int64)((unsigned __int128)(v45 * (__int128)0x346DC5D63886594Bi64) >> 64) >> 11;
if( v21 + (unsigned int)v53 + (v53 >> 63) < v21 )
v95 = -1;
else
v95 = v21 + v53 + (v53 >> 63);
}
LODWORD(v44) = 16515072;
}
v46 = (unsigned int)v44 >> 18;
if( v46 > 0x3F )
LOBYTE(v46) = 63;
BYTE1(v126) = 4 * v46;
}
v27 = KiWaitNever ^ __ROR8__(P2 ^ _byteswap_uint64((unsigned __int64)Dpc ^ KiWaitAlways), KiWaitNever);
v122 = v27;
v124 = KeGetCurrentIrql();
__writecr8(2ui64);
CurrentPrcb = KeGetCurrentPrcb();
v123 = CurrentPrcb;
v121 = 0i64;
v114 = 0i64;
HIDWORD(v102) = 0;
while( 1 )
{
*(_DWORD *)v108 = 0;
while( _interlockedbittestandset((volatile signed __int32 *)P2, 7u) )
{
do
KeYieldProcessorEx((UINT64 *)v108);
while( (*(_DWORD *)P2 & 0x80u) != 0 );
}
if( (*(_BYTE *)(P2 + 3) & 0xC0) == 0 )
break;
v86 = *(unsigned __int8 *)(P2 + 2);
LODWORD(Hand) = *(unsigned __int8 *)(P2 + 2);
p_TimerTable = &(*(&KiProcessorBlock + *(unsigned __int16 *)(P2 + 56)))->TimerTable;
*(_QWORD *)&v104[4] = &p_TimerTable->TimerEntries[(unsigned __int64)*(unsigned __int16 *)(P2 + 58)][v86];
TimerTable = (_KTIMER_TABLE *)KeGetCurrentPrcb();
*(_DWORD *)&v108[4] = 0;
while( 1 )
{
v87 = *(volatile signed __int64 **)&v104[4];
if( !_interlockedbittestandset64(*(volatile signed __int32 **)&v104[4], 0i64) )
break;
do
KeYieldProcessorEx((UINT64 *)&v108[4]);
while( *v87 );
}
v114 = v87;
v27 = v122;
CurrentPrcb = v123;
if( *(char *)(P2 + 3) >= 0 )
{
KiRemoveEntryTimer(p_TimerTable, (_KTIMER *)P2, (unsigned int)Hand);
_InterlockedAnd64(v114, 0i64);
_InterlockedAnd((volatile signed __int32 *)P2, 0xBFFFFFFF);
break;
}
_InterlockedAnd64(*(volatile signed __int64 **)&v104[4], 0i64);
if( _InterlockedExchange64((volatile __int64 *)&p_TimerTable->TimerExpiry[*(_BYTE *)(P2 + 3) & 0x3F], 0i64) )
{
_InterlockedAnd((volatile signed __int32 *)P2, 0xFFFFFFu);
break;
}
_InterlockedAnd((volatile signed __int32 *)P2, 0xFFFFFF7F);
HIDWORD(v102) = 0;
while( *(char *)(P2 + 3) < 0 )
KeYieldProcessorEx((UINT64 *)((char *)&v102 + 4));
}
v31 = 0;
if( (KiVelocityFlags & 0x2000) != 0 )
{
if( CurrentPrcb->NestingLevel
|| ((v29 = KeGetCurrentThread()->ApcState.Process, (v29->Flags & 0x1000) == 0) || (v29->Flags3 & 0x4000000) != 0 ? (v30 = 0) : (v30 = 1),
!v30) )
{
v31 = 1;
}
}
*(_WORD *)(P2 + 58) = v31;
*(_QWORD *)(P2 + 48) = v27;
*(_DWORD *)(P2 + 60) = v95;
v118 = 0i64;
v119 = 0i64;
LODWORD(v118) = *(_DWORD *)P2;
v32 = BYTE1(v126);
BYTE1(v118) = BYTE1(v126);
if( v23 >= 0 )
{
BYTE1(v118) = BYTE1(v126) | 1;
v23 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart - v23;
if( v23 >= 0 )
{
*(_DWORD *)P2 = v118;
*(_QWORD *)(P2 + 24) = 0i64;
goto LABEL_58;
}
v32 = BYTE1(v118);
}
v33 = 0i64;
if( (v32 & 0xFC) != 0 )
v33 = (unsigned __int8)(v32 & 0xFC) << 16;
v34 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v23;
*(_QWORD *)(P2 + 24) = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v23;
BYTE3(v118) |= 0x40u;
BYTE2(v118) = (unsigned __int64)(v33 + v34) >> 18;
*(_DWORD *)P2 = v118;
*(_DWORD *)(P2 + 4) = 0;
if( KiInsertTimerTable(CurrentPrcb, (_KTIMER *)P2, Dpc, (unsigned __int8)((unsigned __int64)(v33 + v34) >> 18), 0i64) )
{
_InterlockedAnd((volatile signed __int32 *)P2, 0xFFFFFF7F);
goto LABEL_33;
}
LABEL_58:
KiTimerWaitTest(CurrentPrcb, (_KTIMER *)P2, 0i64);
LABEL_33:
KiExitDispatcher(CurrentPrcb, 0i64, AdjustUnwait, 0i64, v124);
v35 = v105;
v25 = v93;
v24 = Object;
if( v105 )
_interlockedbittestandset((volatile signed __int32 *)P2, 9u);
LABEL_35:
v36 = *(_DIAGNOSTIC_CONTEXT **)(P2 + 256);
*(_QWORD *)(P2 + 256) = v35;
*(_BYTE *)(P2 + 304) ^= (*(_BYTE *)(P2 + 304) ^ (4 * a7)) & 4;
_InterlockedAnd64((volatile signed __int64 *)(P2 + 64), 0i64);
v37 = KeGetCurrentPrcb();
if( v37->SchedulerAssist && v37->NestingLevel <= 1u && !v20 )
v24 = Object;
if( v25 )
KxReleaseSpinLock(v24 + 305);
__writecr8(CurrentIrql);
if( v94 )
{
if( v36 )
{
if( !v35 )
{
v88 = (_QWORD *)(P2 + 264);
v89 = *(_QWORD *)(P2 + 264);
v90 = *(_QWORD **)(P2 + 272);
if( *(_QWORD *)(v89 + 8) != P2 + 264 || (_QWORD *)*v90 != v88 )
goto LABEL_222;
*v90 = v89;
*(_QWORD *)(v89 + 8) = v90;
*v88 = 0i64;
}
LABEL_95:
v62 = _InterlockedExchangeAdd64((_QWORD *)&WheapDeferredInternalLogsEventLock + 364, 0xFFFFFFFFFFFFFFFFui64);
if( (v62 & 2) != 0 && (v62 & 4) == 0 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364);
*(_DWORD *)v104 = 0;
v63 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&WheapDeferredInternalLogsEventLock + 2912) == 1 )
v64 = (unsigned int)MmGetSessionIdEx(v63->Tcb.ApcState.Process);
else
v64 = 0xFFFFFFFFi64;
--v63->Tcb.SpecialApcDisable;
v65 = ++v63->Tcb.AbAllocationRegionCount;
v103 = 0;
v66 = 0i64;
v67 = ((char)v63->Tcb.AbEntrySummary | (char)v63->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v59 = !_BitScanReverse((unsigned int *)&v68, v67);
v103 = v68;
if( !v59 )
{
while( 1 )
{
v67 &= ~(1 << v68);
v69 = (__int64)&v63->Tcb.LockEntries[v68];
if( (*(_BYTE *)(v69 + 26) & 1) != 0
&& (*(_DWORD *)(v69 + 32) & 1) == 0
&& (*(_QWORD *)(v69 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (((unsigned __int64)&WheapDeferredInternalLogsEventLock
+ 2912) & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v69 + 40) == (_DWORD)v64 )
{
*(_BYTE *)(v69 + 26) &= ~1u;
if( *(_QWORD *)(v69 + 32) )
break;
}
v59 = !_BitScanReverse((unsigned int *)&v68, v67);
v103 = v68;
if( v59 )
goto LABEL_105;
}
v66 = (_KLOCK_ENTRY *)v69;
}
LABEL_105:
if( v66 )
{
v66->CrossThreadReleasableAndBusyByte |= 2u;
if( v66->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v66);
v70.AllFields = (unsigned int)v66->BoostBitmap;
*(_DWORD *)v104 = v70.AllFields & 0x1FFFF;
v66->BoostBitmap.AllFields = v70.AllFields & 0xFFFE0000;
v66->ThreadLocalFlags &= ~1u;
v66->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v71 = 1 << (v66 - v63->Tcb.LockEntries);
if( v65 == 1 )
v63->Tcb.AbEntrySummary |= v71;
else
_InterlockedOr8((volatile signed __int8 *)&v63->Tcb.AbOrphanedEntrySummary, v71);
}
else if( (*(&v63->Tcb.MiscFlags + 1) & 0x10000) == 0 )
{
KeBugCheckEx(0x162u, v63, (char *)&WheapDeferredInternalLogsEventLock + 2912, (PVOID)v64, 0i64);
}
--v63->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v63->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, (UINT64 *)v104);
v59 = v63->Tcb.SpecialApcDisable++ == -1;
if( v59 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v63->Tcb.ApcState.ApcListHead[0].Flink != &v63->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegionThread(&Thread->Tcb);
if( v36 )
PoDestroyReasonContext(v36);
goto LABEL_39;
}
if( !v35 )
goto LABEL_95;
v60 = (_QWORD *)(P2 + 264);
v61 = (_QWORD *)*(&WheapDeferredInternalLogsEventLock + 367);
if( (_UNKNOWN *)**(&WheapDeferredInternalLogsEventLock + 367) == (_UNKNOWN *)((char *)&WheapDeferredInternalLogsEventLock
+ 2928) )
{
*v60 = (char *)&WheapDeferredInternalLogsEventLock + 2928;
*(_QWORD *)(P2 + 272) = v61;
*v61 = v60;
*(&WheapDeferredInternalLogsEventLock + 367) = P2 + 264;
goto LABEL_95;
}
LABEL_222:
__fastfail(3u);
}
LABEL_39:
if( v19 )
{
ObpTraceObjectDereferenceIfActive((_OBJECT_HEADER *)(P2 - 48), v19, 0x746C6644ui64);
v38 = (void *)(_InterlockedExchangeAdd64((volatile signed __int64 *)(P2 - 48), -v19) - v19);
if( (__int64)v38 <= 0 )
{
if( *(_QWORD *)(P2 - 40) )
KeBugCheckEx(
0x18u,
(PVOID)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(P2 - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)(P2 - 48) >> 8)],
(PVOID)P2,
(PVOID)6,
*(PVOID *)(P2 - 40));
if( (__int64)v38 < 0 )
KeBugCheckEx(0x18u, 0i64, (PVOID)P2, (PVOID)5, v38);
ObpDeferObjectDeletion((_OBJECT_HEADER *)(P2 - 48));
}
}
v39 = v125;
if( !v125 )
return v96;
if( !a2 )
{
*v125 = v97;
return v96;
}
v91 = (__int64)v125;
if( (unsigned __int64)v125 >= 0x7FFFFFFF0000i64 )
v91 = 0x7FFFFFFF0000i64;
*(_BYTE *)v91 = *(_BYTE *)v91;
*v39 = v97;
return v96;
}Referenced by:
ExpSetTimer
NtSetTimerEx