KiAbEntryGetLockedHeadEntry
unsigned __int64 __fastcall KiAbEntryGetLockedHeadEntry(
unsigned __int64 a1,
int a2,
struct _KLOCK_QUEUE_HANDLE *a3,
void *a4){
unsigned __int64 v4;
bool v5;
unsigned __int64 v8;
int v9;
unsigned __int64 v10;
INT64 *v11;
unsigned __int64 *v12;
WORK_QUEUE_TYPE v13;
void *v14;
unsigned __int64 v15;
unsigned __int64 v16;
int v17;
unsigned __int64 v18;
unsigned int v19;
unsigned __int64 v20;
signed __int32 v21;
unsigned __int64 v22;
bool v23;
unsigned __int64 v24;
unsigned int v25;
unsigned __int64 v26;
unsigned __int64 v27;
WORK_QUEUE_TYPE v28;
PVOID v29;
unsigned __int64 v30;
char v32;
unsigned __int64 *v33;
unsigned __int64 v34;
bool v35;
int v36;
unsigned __int64 v37;
CHAR v38;
CHAR v39;
unsigned __int64 v40;
int v41;
unsigned __int64 v42;
WORK_QUEUE_TYPE v43;
void *v44;
signed __int32 v45;
INT64 v46;
int v47;
int v48;
__int128 v49;
struct _IO_WORKITEM LockHandle;
UINT64 SpinCount;
v4 = 0i64;
v5 = (*(_BYTE *)(a1 + 27) & 1) == 0;
v48 = 0;
v8 = a1;
memset(&LockHandle, 0, 24);
if( !v5 )
{
a3->LockQueue.Next = 0i64;
a3->LockQueue.Lock = (unsigned __int64 *volatile)(a1 + 80);
KxAcquireQueuedSpinLock((PIO_WORKITEM)a3, (PIO_WORKITEM_ROUTINE)(a1 + 80), (WORK_QUEUE_TYPE)a3, a4);
if( (*(_BYTE *)(v8 + 27) & 1) != 0 )
return v8;
KeReleaseInStackQueuedSpinLockFromDpcLevel(a3);
}
v49 = *(_OWORD *)(v8 + 32);
if( (__int64)v49 >= 0 && !a2 )
return 0i64;
v9 = 0;
v46 = v49 & 0x7FFFFFFFFFFFFFFCi64;
v10 = ((((unsigned __int64)v49 & 0x7FFFFFFFFFFFFFFCi64) >> 4) & 0x3FF) << 6;
v47 = DWORD2(v49);
v11 = (__int64 *)((char *)&KiAbTreeArray[2] + v10);
v12 = (unsigned __int64 *)((char *)KiAbTreeArray + v10);
while( 1 )
{
if( v9 )
ExAcquireSpinLockExclusiveAtDpcLevel(v11);
else
ExAcquireSpinLockSharedAtDpcLevel((PEX_SPIN_LOCK)v11);
v15 = v12[1];
v16 = *v12;
if( (v15 & 1) != 0 )
{
if( v16 )
v16 ^= (unsigned __int64)v12;
else
v16 = 0i64;
}
v17 = v15 & 1;
if( v16 )
{
while( 1 )
{
v18 = *(_QWORD *)(v16 + 32) & 0x7FFFFFFFFFFFFFFCi64;
if( v18 < v46 )
goto LABEL_36;
if( v18 > v46 )
goto LABEL_16;
v19 = *(_DWORD *)(v16 + 40);
if( v19 == DWORD2(v49) )
goto LABEL_19;
if( v19 < DWORD2(v49) )
{
LABEL_36:
v20 = *(_QWORD *)(v16 + 8);
if( v17 && v20 )
{
LABEL_40:
v16 ^= v20;
goto LABEL_18;
}
}
else
{
LABEL_16:
v20 = *(_QWORD *)v16;
if( v17 && v20 )
goto LABEL_40;
}
v16 = v20;
LABEL_18:
if( !v16 )
{
LABEL_19:
v8 = a1;
break;
}
}
}
if( !a2 )
{
if( v16 )
{
v27 = v16;
a3->LockQueue.Lock = (unsigned __int64 *volatile)(v16 + 80);
a3->LockQueue.Next = 0i64;
KxAcquireQueuedSpinLock((PIO_WORKITEM)a3, (PIO_WORKITEM_ROUTINE)(v16 + 80), v13, v14);
if( v9 )
ExReleaseSpinLockExclusiveFromDpcLevel(v11);
else
ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v11);
if( v8 == v16 )
return v27;
LockHandle.WorkItem.List.Flink = 0i64;
LockHandle.WorkItem.List.Blink = (_LIST_ENTRY *)(v8 + 80);
KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)(v8 + 80), v43, v44);
KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
if( KiAbCompareSnappedEntryState((__m128i *)v8, (INT64)&v46) )
return v27;
KeReleaseInStackQueuedSpinLockFromDpcLevel(a3);
}
else if( v9 )
{
ExReleaseSpinLockExclusiveFromDpcLevel(v11);
}
else
{
ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v11);
}
return 0i64;
}
if( v16 )
break;
if( v9 )
goto LABEL_25;
v9 = 1;
LODWORD(SpinCount) = 0;
if( !_interlockedbittestandset((volatile signed __int32 *)v11, 0x1Fu) )
{
v21 = *(_DWORD *)v11;
while( (v21 & 0xBFFFFFFF) != -2147483647 )
{
if( (v21 & 0x40000000) == 0 )
{
v45 = _InterlockedCompareExchange((volatile signed __int32 *)v11, v21 | 0x40000000, v21);
v5 = v21 == v45;
v21 = v45;
if( !v5 )
continue;
}
KeYieldProcessorEx(&SpinCount);
v21 = *(_DWORD *)v11;
}
LABEL_25:
v22 = *v12;
if( (v12[1] & 1) != 0 )
{
if( v22 )
v22 ^= (unsigned __int64)v12;
else
v22 = 0i64;
}
v23 = 0;
if( v22 )
{
while( 1 )
{
v24 = *(_QWORD *)(v22 + 32) & 0x7FFFFFFFFFFFFFFCi64;
if( v24 < v46 || v24 <= v46 && ((v25 = *(_DWORD *)(v22 + 40), v25 == DWORD2(v49)) || v25 < DWORD2(v49)) )
{
v26 = *(_QWORD *)(v22 + 8);
if( (v12[1] & 1) != 0 )
{
if( !v26 )
goto LABEL_45;
v26 ^= v22;
}
if( !v26 )
{
LABEL_45:
v23 = 1;
break;
}
}
else
{
v26 = *(_QWORD *)v22;
if( (v12[1] & 1) != 0 )
{
if( !v26 )
goto LABEL_46;
v26 ^= v22;
}
if( !v26 )
{
LABEL_46:
v23 = 0;
break;
}
}
v22 = v26;
}
}
RtlRbInsertNodeEx(v12, v22, v23, v8);
v27 = v8;
a3->LockQueue.Lock = (unsigned __int64 *volatile)(v8 + 80);
a3->LockQueue.Next = 0i64;
KxAcquireQueuedSpinLock((PIO_WORKITEM)a3, (PIO_WORKITEM_ROUTINE)(v8 + 80), v28, v29);
ExReleaseSpinLockExclusiveFromDpcLevel(v11);
*(_BYTE *)(v8 + 39) |= 0x80u;
*(_BYTE *)(v8 + 27) |= 1u;
*(_QWORD *)(v8 + 48) = 0i64;
*(_QWORD *)(v8 + 56) = 0i64;
*(_QWORD *)(v8 + 64) = 0i64;
*(_QWORD *)(v8 + 72) = 0i64;
*(_WORD *)(v8 + 90) &= 1u;
LABEL_48:
v30 = v8 - 16i64 * *(unsigned __int8 *)(v8 + 24);
if( (*(_BYTE *)(v8 + 25) & 1) != 0 )
++*(_BYTE *)(v30 + 793);
else
_InterlockedExchangeAdd8((volatile signed __int8 *)(v30 + 871), 1u);
return v27;
}
ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v11);
}
v27 = v16;
a3->LockQueue.Lock = (unsigned __int64 *volatile)(v16 + 80);
a3->LockQueue.Next = 0i64;
KxAcquireQueuedSpinLock((PIO_WORKITEM)a3, (PIO_WORKITEM_ROUTINE)(v16 + 80), v13, v14);
if( v9 )
ExReleaseSpinLockExclusiveFromDpcLevel(v11);
else
ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v11);
if( *(__int64 *)(v8 + 32) >= 0 )
{
if( (*(_BYTE *)(v8 + 25) & 1) != 0 )
{
v32 = *(_BYTE *)(v8 - 16i64 * *(unsigned __int8 *)(v8 + 24) + 195);
if( v32 > 15 )
v32 = 15;
v33 = (unsigned __int64 *)(v16 + 64);
*(_BYTE *)(v8 + 48) = v32;
v34 = v33[1];
if( (v34 & 1) != 0 )
{
if( *v33 )
v4 = *v33 ^ (unsigned __int64)v33;
}
else
{
v4 = *v33;
}
v35 = 0;
v36 = v34 & 1;
if( v4 )
{
while( 1 )
{
if( *(char *)(v4 + 48) < v32 )
{
v37 = *(_QWORD *)v4;
if( v36 )
{
if( !v37 )
break;
v37 ^= v4;
}
if( !v37 )
break;
}
else
{
v37 = *(_QWORD *)(v4 + 8);
if( v36 )
{
if( !v37 )
goto LABEL_69;
v37 ^= v4;
}
if( !v37 )
goto LABEL_69;
}
v4 = v37;
}
}
}
else
{
v38 = KiAbOwnerComputeCpuPriorityKey((_KLOCK_ENTRY *)v8);
v33 = (unsigned __int64 *)(v16 + 48);
*(_BYTE *)(v8 + 48) = v38;
v39 = v38;
v40 = v33[1];
if( (v40 & 1) != 0 )
{
if( *v33 )
v4 = *v33 ^ (unsigned __int64)v33;
}
else
{
v4 = *v33;
}
v35 = 0;
v41 = v40 & 1;
if( v4 )
{
while( 1 )
{
if( *(char *)(v4 + 48) > v39 )
{
v42 = *(_QWORD *)v4;
if( v41 )
{
if( !v42 )
break;
v42 ^= v4;
}
if( !v42 )
break;
}
else
{
v42 = *(_QWORD *)(v4 + 8);
if( v41 )
{
if( !v42 )
goto LABEL_69;
v42 ^= v4;
}
if( !v42 )
{
LABEL_69:
v35 = 1;
break;
}
}
v4 = v42;
}
}
}
RtlRbInsertNodeEx(v33, v4, v35, v8);
*(_BYTE *)(v8 + 39) |= 0x80u;
goto LABEL_48;
}
return v27;
}Referenced by:
KiAbForceProcessLockEntry
KiAbProcessContextSwitch
KiAbProcessThreadLocks