NtWaitForDebugEvent

NTSTATUS __fastcall NtWaitForDebugEvent(VOID *Handle, BOOL a2, LARGE_INTEGER *a3, _OWORD *a4){
  bool v5; 
  char v7; 
  KPROCESSOR_MODE v8; 
  __int64 v9; 
  NTSTATUS v10; 
  BOOLEAN v11; 
  char *v12; 
  int v13; 
  __int64 v14; 
  _QWORD *v15; 
  INT64 i; 
  INT64 v17; 
  _QWORD *v18; 
  int v19; 
  bool v20; 
  _OWORD *v21; 
  IRP *Object; 
  bool Alertable; 
  LONGLONG QuadPart; 
  PLARGE_INTEGER Timeout; 
  PVOID VirtualAddress; 
  __int64 v27; 
  PVOID v28; 
  PVOID v29; 
  __int128 result[11]; 
  __int64 v31; 
  v5 = a2;
  Alertable = a2;
  Timeout = a3;
  v7 = 0;
  QuadPart = 0i64;
  v27 = 0i64;
  v8 = *((_BYTE *)KeGetCurrentThread() + 562);
  memset((INT64)result, 0i64);
  if( Timeout )
  {
    QuadPart = Timeout->QuadPart;
    Timeout = (PLARGE_INTEGER)&QuadPart;
    v27 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
  }
  if( v8 )
  {
    v9 = (__int64)a4;
    if( (unsigned __int64)a4 >= 0x7FFFFFFF0000i64 )
      v9 = 0x7FFFFFFF0000i64;
    *(_BYTE *)v9 = *(_BYTE *)v9;
    *(_BYTE *)(v9 + 183) = *(_BYTE *)(v9 + 183);
  }
  VirtualAddress = 0i64;
  v10 = ObReferenceObjectByHandle(Handle, 1u, DbgkDebugObjectType, v8, &VirtualAddress, 0i64);
  if( v10 >= 0 )
  {
    v28 = 0i64;
    v29 = 0i64;
    v11 = v5;
    v12 = (char *)VirtualAddress;
    while( 1 )
    {
      v19 = KeWaitForSingleObject(v12, Executive, v8, v11, Timeout);
      if( v19 < 0 || v19 == 192 || (unsigned int)(v19 - 257) <= 1 )
        break;
      ExAcquireFastMutex((FAST_MUTEX *)(v12 + 24));
      if( (*((_DWORD *)v12 + 24) & 1) != 0 )
      {
        v19 = -1073740972;
      }
      else
      {
        v15 = v12 + 80;
        for( i = *((_QWORD *)v12 + 10); ; i = *(_QWORD *)i )
        {
          if( (_QWORD *)i == v15 )
          {
            KeResetEvent(v12, (UINT64)v15, v13, v14, Object);
            goto LABEL_25;
          }
          v17 = i;
          v13 = *(_DWORD *)(i + 76);
          if( (v13 & 5) == 0 )
          {
            v7 = 1;
            v18 = (_QWORD *)*v15;
            if( *v15 != i )
            {
              v14 = *(_QWORD *)(i + 40);
              while( v14 != v18[5] )
              {
                v18 = (_QWORD *)*v18;
                if( v18 == (_QWORD *)i )
                  goto LABEL_20;
              }
              v13 |= 4u;
              *(_DWORD *)(i + 76) = v13;
              *(_QWORD *)(i + 80) = 0i64;
              v7 = 0;
            }
LABEL_20:
            if( v7 )
              break;
          }
        }
        v28 = *(PVOID *)(i + 56);
        v29 = *(PVOID *)(i + 64);
        ObfReferenceObjectWithTag(v29, 0x4F676244u);
        ObfReferenceObjectWithTag(v28, 0x4F676244u);
        DbgkpConvertKernelToUserStateChange((INT64)result, v17);
        *(_DWORD *)(v17 + 76) |= 1u;
LABEL_25:
        v19 = 0;
      }
      KeReleaseGuardedMutex((_FAST_MUTEX *)(v12 + 24));
      if( v19 < 0 )
        break;
      if( v7 )
      {
        DbgkpOpenHandles((INT64)result, v28, v29);
        ObfDereferenceObjectWithTag(v29, 0x4F676244ui64);
        ObfDereferenceObjectWithTag(v28, 0x4F676244ui64);
        break;
      }
      v7 = 0;
      if( QuadPart < 0 )
      {
        v20 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart - v27 + QuadPart < 0;
        QuadPart += *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart - v27;
        v27 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
        v12 = (char *)VirtualAddress;
        if( !v20 )
        {
          v19 = 258;
          break;
        }
      }
      v11 = Alertable;
    }
    HalPutDmaAdapter((PADAPTER_OBJECT)v12);
    *a4 = result[0];
    a4[1] = result[1];
    a4[2] = result[2];
    a4[3] = result[3];
    a4[4] = result[4];
    a4[5] = result[5];
    a4[6] = result[6];
    v21 = a4 + 8;
    *(v21 - 1) = result[7];
    *v21 = result[8];
    v21[1] = result[9];
    v21[2] = result[10];
    *((_QWORD *)v21 + 6) = v31;
    return v19;
  }
  return v10;
}

Referenced by: