ExpSetTimerObject
INT64 __fastcall ExpSetTimerObject(
UINT64 P2,
CHAR a2,
INT64 *a3,
volatile INT32 *a4,
INT64 a5,
INT64 a6,
CHAR a7,
UINT64 a8,
UINT64 a9,
BYTE *a10){
CHAR v10;
char v12;
__int64 v13;
char v14;
int v15;
unsigned __int8 v16;
unsigned int v17;
INT64 v18;
unsigned int v19;
unsigned int v20;
unsigned int v21;
__int64 *v22;
__int64 v23;
UINT64 *v24;
char v25;
__int64 v26;
__int64 v27;
struct _KPRCB *CurrentPrcb;
__int64 v29;
char v30;
__int16 v31;
char v32;
__int64 v33;
__int64 v34;
INT64 v35;
void *v36;
struct _KPRCB *v37;
signed __int64 v38;
BYTE *v39;
__int64 v41;
volatile signed __int32 *v42;
_KTIMER_TABLE *v43;
unsigned __int64 v44;
signed __int64 v45;
unsigned int v46;
__int64 v47;
_ETHREAD *v48;
UINT64 *v49;
char *v50;
char *v51;
char **v52;
unsigned __int64 v53;
_ETHREAD *v54;
__int64 v55;
char v56;
__int64 v57;
int SessionId;
bool v59;
_QWORD *v60;
_QWORD *v61;
char v62;
_ETHREAD *v63;
ULONG_PTR v64;
char v65;
unsigned __int64 v66;
int v67;
__int64 v68;
__int64 v69;
int v70;
unsigned __int8 v71;
unsigned int v72;
__int64 v73;
_ETHREAD *v74;
__int64 v75;
__int64 v76;
char v77;
__int64 v78;
int v79;
unsigned __int8 v80;
__int64 v81;
__int64 v82;
_QWORD *v83;
unsigned int v84;
__int64 v85;
volatile signed __int64 *v86;
_QWORD *v87;
__int64 v88;
_QWORD *v89;
__int64 v90;
ULONG_PTR BugCheckParameter4;
char v93;
char v94;
int v95;
unsigned int v96;
BYTE v97;
UINT64 *Object;
unsigned __int8 CurrentIrql;
INT64 v100;
_KTIMER_TABLE *v101;
UINT64 v102;
int v103;
int v104;
INT64 v105;
INT64 v106;
_KTIMER_TABLE *TimerTable;
int v108;
UINT64 v109;
UINT64 Hand;
int v111;
unsigned int v112;
int v113;
volatile signed __int32 *v114;
unsigned int v115;
volatile signed __int64 *v116;
_KDPC *Dpc;
_ETHREAD *CurrentThread;
UINT64 SpinCount;
__int128 v120;
__int64 v121;
__int64 v122;
__int64 v123;
__int64 v124;
struct _KPRCB *v125;
__int64 v126;
BYTE *v127;
__int128 v128;
__int64 v129;
v105 = (INT64)a4;
Hand = (UINT64)a3;
v10 = a2;
v127 = a10;
v96 = 0;
v12 = 0;
v94 = 0;
CurrentThread = 0i64;
v106 = a6;
if( !a6 )
goto LABEL_2;
if( a7 )
{
if( !ExpCheckTestsigningEnabled() )
{
v72 = ExpCheckWakeTimerAccess(*((_BYTE *)KeGetCurrentThread() + 562));
v96 = v72;
if( v72 )
{
ObfDereferenceObjectWithTag((PVOID)P2, 0x746C6644ui64);
return v72;
}
}
v10 = a2;
}
if( (int)qword_140C23E80 < 2 && !PresentFlag )
{
v96 = 1073741861;
v106 = 0i64;
goto LABEL_2;
}
v12 = 1;
v94 = 1;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v112 = 0;
v54 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v54 + 243);
if( ++*((_BYTE *)v54 + 794) != 1 )
KeBugCheckEx(0x192u, (ULONG_PTR)v54, (ULONG_PTR)&ExpWakeTimerLock, KeGetCurrentIrql(), 0i64);
v111 = 0;
LOBYTE(v55) = *((_BYTE *)v54 + 792);
if( !(_BYTE)v55 )
{
if( !*((_BYTE *)v54 + 870) )
{
v57 = 0i64;
goto LABEL_79;
}
v73 = *((unsigned __int8 *)v54 + 870);
*((_BYTE *)v54 + 870) = 0;
LOBYTE(v55) = v73 | *((_BYTE *)v54 + 792);
}
v56 = v55;
_BitScanForward((unsigned int *)&v55, (unsigned __int8)v55);
v111 = v55;
*((_BYTE *)v54 + 792) = v56 & ~(1 << v55);
v57 = *((_QWORD *)v54 + 100) + 96 * v55;
LABEL_79:
if( v57 )
{
if( (unsigned __int64)&ExpWakeTimerLock >= 0xFFFF800000000000ui64
&& *((_BYTE *)&antNameB + (((unsigned __int64)&ExpWakeTimerLock >> 39) & 0x1FF) - 256) == 1 )
{
SessionId = MmGetSessionIdEx(*((_QWORD *)v54 + 23));
}
else
{
SessionId = -1;
}
*(_DWORD *)(v57 + 40) = SessionId;
*(_QWORD *)(v57 + 32) = (unsigned __int64)&ExpWakeTimerLock & 0x7FFFFFFFFFFFFFFCi64;
}
else
{
_interlockedbittestandset((volatile signed __int32 *)v54 + 30, 0x10u);
}
--*((_BYTE *)v54 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v54, (__int64)&ExpWakeTimerLock, &v112);
v59 = (*((_WORD *)v54 + 243))++ == 0xFFFF;
if( v59 && *((_ETHREAD **)v54 + 19) != (_ETHREAD *)((char *)v54 + 152) )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)&ExpWakeTimerLock, 0i64) )
ExfAcquirePushLockExclusiveEx(&ExpWakeTimerLock, (VOID *)v57, &ExpWakeTimerLock);
v10 = a2;
if( v57 )
*(_BYTE *)(v57 + 26) |= 1u;
LABEL_2:
Dpc = 0i64;
v13 = *((_QWORD *)KeGetCurrentThread() + 23);
Object = (UINT64 *)v13;
v14 = 0;
v93 = 0;
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
if( v10 && (*(_DWORD *)(v13 + 632) & 0x10) != 0 )
{
KxAcquireSpinLock((UINT64 *)(v13 + 2440));
v14 = 1;
v93 = 1;
}
if( _interlockedbittestandset64((volatile signed __int32 *)(P2 + 64), 0i64) )
KxWaitForSpinLockAndAcquire((UINT64 *)(P2 + 64));
if( !v12 && *(_QWORD *)(P2 + 256) )
{
KxReleaseSpinLock((UINT64 *)(P2 + 64));
if( v14 )
KxReleaseSpinLock((UINT64 *)(v13 + 2440));
__writecr8(CurrentIrql);
v94 = 1;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v115 = 0;
v74 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v74 + 243);
if( ++*((_BYTE *)v74 + 794) != 1 )
KeBugCheckEx(0x192u, (ULONG_PTR)v74, (ULONG_PTR)&ExpWakeTimerLock, KeGetCurrentIrql(), 0i64);
v113 = 0;
LOBYTE(v75) = *((_BYTE *)v74 + 792);
if( !(_BYTE)v75 )
{
if( !*((_BYTE *)v74 + 870) )
{
v78 = 0i64;
goto LABEL_147;
}
v76 = *((unsigned __int8 *)v74 + 870);
*((_BYTE *)v74 + 870) = 0;
LOBYTE(v75) = v76 | *((_BYTE *)v74 + 792);
}
v77 = v75;
_BitScanForward((unsigned int *)&v75, (unsigned __int8)v75);
v113 = v75;
*((_BYTE *)v74 + 792) = v77 & ~(1 << v75);
v78 = *((_QWORD *)v74 + 100) + 96 * v75;
LABEL_147:
if( v78 )
{
if( (unsigned __int64)&ExpWakeTimerLock >= 0xFFFF800000000000ui64
&& *((_BYTE *)&antNameB + (((unsigned __int64)&ExpWakeTimerLock >> 39) & 0x1FF) - 256) == 1 )
{
v79 = MmGetSessionIdEx(*((_QWORD *)v74 + 23));
}
else
{
v79 = -1;
}
*(_DWORD *)(v78 + 40) = v79;
*(_QWORD *)(v78 + 32) = (unsigned __int64)&ExpWakeTimerLock & 0x7FFFFFFFFFFFFFFCi64;
}
else
{
_interlockedbittestandset((volatile signed __int32 *)v74 + 30, 0x10u);
}
--*((_BYTE *)v74 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v74, (__int64)&ExpWakeTimerLock, &v115);
v59 = (*((_WORD *)v74 + 243))++ == 0xFFFF;
if( v59 && *((_ETHREAD **)v74 + 19) != (_ETHREAD *)((char *)v74 + 152) )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)&ExpWakeTimerLock, 0i64) )
ExfAcquirePushLockExclusiveEx(&ExpWakeTimerLock, (VOID *)v78, &ExpWakeTimerLock);
if( v78 )
*(_BYTE *)(v78 + 26) |= 1u;
v80 = KeGetCurrentIrql();
__writecr8(2ui64);
CurrentIrql = v80;
if( v93 )
KxAcquireSpinLock(Object + 305);
KxAcquireSpinLock((UINT64 *)(P2 + 64));
}
v15 = 0;
if( (*(_BYTE *)(P2 + 304) & 1) != 0 )
{
v81 = *(_QWORD *)(P2 + 80);
KxAcquireSpinLock((UINT64 *)(v81 + 1120));
v82 = *(_QWORD *)(P2 + 224);
v83 = *(_QWORD **)(P2 + 232);
if( *(_QWORD *)(v82 + 8) != P2 + 224 || *v83 != P2 + 224 )
goto LABEL_222;
*v83 = v82;
*(_QWORD *)(v82 + 8) = v83;
KxReleaseSpinLock((UINT64 *)(v81 + 1120));
*(_BYTE *)(P2 + 304) &= ~1u;
if( (*(_BYTE *)(P2 + 304) & 2) != 0 && *(_BYTE *)(P2 + 248)
|| KeCancelTimer((PKTIMER)P2)
|| KeRemoveQueueDpcEx((_KDPC *)(P2 + 160), 0) )
{
v15 = 1;
}
v18 = P2 + 72;
if( KeRemoveQueueApc((_KAPC *)(P2 + 72)) )
++v15;
}
else
{
v16 = KeGetCurrentIrql();
__writecr8(2ui64);
v122 = 0i64;
v114 = 0i64;
LODWORD(v102) = 0;
while( 1 )
{
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset((volatile signed __int32 *)P2, 7u) )
{
do
KeYieldProcessorEx(&SpinCount);
while( (*(_DWORD *)P2 & 0x80u) != 0 );
}
if( (*(_BYTE *)(P2 + 3) & 0xC0) == 0 )
{
v17 = -129;
goto LABEL_14;
}
v41 = *(unsigned __int8 *)(P2 + 2);
TimerTable = (_KTIMER_TABLE *)((char *)*(&KiProcessorBlock + *(unsigned __int16 *)(P2 + 56)) + 14656);
v42 = (volatile signed __int32 *)((char *)TimerTable
+ 0x2000 * (unsigned __int64)*(unsigned __int16 *)(P2 + 58)
+ 32 * v41
+ 512);
HIDWORD(SpinCount) = 0;
while( _interlockedbittestandset64(v42, 0i64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( *(_QWORD *)v42 );
}
v114 = v42;
v43 = TimerTable;
if( *(char *)(P2 + 3) >= 0 )
{
KiRemoveEntryTimer(TimerTable, (_KTIMER *)P2, (unsigned int)v41);
_InterlockedAnd64((volatile signed __int64 *)v114, 0i64);
v17 = -1073741953;
goto LABEL_14;
}
_InterlockedAnd64((volatile signed __int64 *)v42, 0i64);
if( _InterlockedExchange64((volatile __int64 *)v43 + (*(_BYTE *)(P2 + 3) & 0x3F), 0i64) )
break;
_InterlockedAnd((volatile signed __int32 *)P2, 0xFFFFFF7F);
LODWORD(v102) = 0;
while( *(char *)(P2 + 3) < 0 )
KeYieldProcessorEx(&v102);
}
v17 = 16777087;
LABEL_14:
_InterlockedAnd((volatile signed __int32 *)P2, v17);
__writecr8(v16);
v18 = P2 + 72;
v15 = 0;
}
*(_BYTE *)(P2 + 248) = 0;
v19 = v15 + 1;
v20 = *(_DWORD *)(P2 + 4);
v97 = v20;
v21 = a8;
v95 = a8;
*(_DWORD *)(P2 + 240) = a8;
*(_DWORD *)(P2 + 244) = 0;
*(_DWORD *)(P2 + 320) = a9;
if( v105 )
{
v48 = (_ETHREAD *)KeGetCurrentThread();
KeInitializeApc(v18, (INT64)v48, 2i64, (INT64)ExpTimerApcRoutine, 0i64, v105, a2, a5);
v49 = (UINT64 *)((char *)v48 + 1120);
KxAcquireSpinLock((UINT64 *)v48 + 140);
v50 = (char *)(P2 + 224);
v51 = (char *)v48 + 1128;
v52 = (char **)*((_QWORD *)v51 + 1);
if( *v52 != v51 )
goto LABEL_222;
*(_QWORD *)v50 = v51;
*(_QWORD *)(P2 + 232) = v52;
*v52 = v50;
*((_QWORD *)v51 + 1) = v50;
*(_BYTE *)(P2 + 304) |= 1u;
KxReleaseSpinLock(v49);
Dpc = (_KDPC *)(P2 + 160);
v19 = v15;
v21 = 0;
v95 = 0;
}
LOBYTE(a4) = 0;
v22 = (__int64 *)Hand;
v23 = *(_QWORD *)Hand;
v100 = *(_QWORD *)Hand;
v24 = Object;
v25 = v93;
if( v93 )
{
if( !*(_QWORD *)(P2 + 280) )
{
PsInsertVirtualizedTimer(Object, P2 + 280);
v21 = v95;
v24 = Object;
}
_InterlockedIncrement((volatile signed __int32 *)v24 + 606);
v20 = *((_DWORD *)v24 + 158);
if( (v20 & 0x10) != 0 )
{
v47 = *((unsigned int *)v24 + 17);
if( (_DWORD)v47 )
{
v108 = *((_DWORD *)v24 + 17);
v23 = *v22;
if( *v22 >= 0 )
{
if( (unsigned __int64)v23 <= *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart )
v23 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
v23 += v47;
if( v23 < *v22 )
v23 = *v22;
LODWORD(v47) = v108;
}
else if( v23 - v47 <= v23 )
{
v23 -= v47;
}
HIDWORD(v100) = HIDWORD(v23);
v84 = (unsigned int)v47 / 0x2710;
if( v21 )
{
v20 = v84 + v21;
if( v84 + v21 > v21 )
{
v21 += v84;
v95 = v20;
*(_DWORD *)(P2 + 240) += v84;
LABEL_194:
*(_DWORD *)(P2 + 244) = v84;
goto LABEL_17;
}
}
v20 = *(_DWORD *)(P2 + 240);
if( v20 && v20 + v84 > v20 )
{
*(_DWORD *)(P2 + 240) = v20 + v84;
goto LABEL_194;
}
}
}
}
LABEL_17:
if( (*(_BYTE *)(P2 + 304) & 2) != 0 )
{
*(_QWORD *)(P2 + 312) = v23;
v35 = v106;
if( v100 < 0 )
{
LOBYTE(v20) = (v106 != 0) + 2;
*(_BYTE *)(P2 + 248) = v20;
}
else
{
*(_BYTE *)(P2 + 248) = 1;
}
goto LABEL_35;
}
v26 = v23;
v128 = 0i64;
v129 = 0i64;
if( (_DWORD)a9 )
{
v44 = 10000i64 * (unsigned int)a9;
if( v44 > 0xFC0000 )
{
v45 = v44 - 16515072;
if( v23 >= 0 )
{
v23 += v45;
if( v23 < v26 )
v23 = 0x7FFFFFFFFFFFFFFFi64;
}
else
{
v23 -= v45;
if( v23 > v26 )
v23 = 0x8000000000000000ui64;
}
if( v21 )
{
v53 = (__int64)((unsigned __int128)(v45 * (__int128)0x346DC5D63886594Bi64) >> 64) >> 11;
if( v21 + (unsigned int)v53 + (v53 >> 63) < v21 )
v95 = -1;
else
v95 = v21 + v53 + (v53 >> 63);
}
LODWORD(v44) = 16515072;
}
v46 = (unsigned int)v44 >> 18;
if( v46 > 0x3F )
LOBYTE(v46) = 63;
BYTE1(v128) = 4 * v46;
}
v27 = KiWaitNever ^ __ROR8__(P2 ^ _byteswap_uint64((unsigned __int64)Dpc ^ KiWaitAlways), KiWaitNever);
v124 = v27;
v126 = KeGetCurrentIrql();
__writecr8(2ui64);
CurrentPrcb = KeGetCurrentPrcb();
v125 = CurrentPrcb;
v123 = 0i64;
v116 = 0i64;
HIDWORD(v102) = 0;
while( 1 )
{
LODWORD(v109) = 0;
while( _interlockedbittestandset((volatile signed __int32 *)P2, 7u) )
{
do
KeYieldProcessorEx(&v109);
while( (*(_DWORD *)P2 & 0x80u) != 0 );
}
if( (*(_BYTE *)(P2 + 3) & 0xC0) == 0 )
break;
v85 = *(unsigned __int8 *)(P2 + 2);
LODWORD(Hand) = *(unsigned __int8 *)(P2 + 2);
v101 = (_KTIMER_TABLE *)((char *)*(&KiProcessorBlock + *(unsigned __int16 *)(P2 + 56)) + 14656);
v105 = (INT64)v101 + 0x2000 * (unsigned __int64)*(unsigned __int16 *)(P2 + 58) + 32 * v85 + 512;
TimerTable = (_KTIMER_TABLE *)KeGetCurrentPrcb();
HIDWORD(v109) = 0;
while( 1 )
{
v86 = (volatile signed __int64 *)v105;
if( !_interlockedbittestandset64((volatile signed __int32 *)v105, 0i64) )
break;
do
KeYieldProcessorEx((UINT64 *)((char *)&v109 + 4));
while( *v86 );
}
v116 = v86;
v27 = v124;
CurrentPrcb = v125;
if( *(char *)(P2 + 3) >= 0 )
{
KiRemoveEntryTimer(v101, (_KTIMER *)P2, (unsigned int)Hand);
_InterlockedAnd64(v116, 0i64);
_InterlockedAnd((volatile signed __int32 *)P2, 0xBFFFFFFF);
break;
}
_InterlockedAnd64((volatile signed __int64 *)v105, 0i64);
if( _InterlockedExchange64((volatile __int64 *)v101 + (*(_BYTE *)(P2 + 3) & 0x3F), 0i64) )
{
_InterlockedAnd((volatile signed __int32 *)P2, 0xFFFFFFu);
break;
}
_InterlockedAnd((volatile signed __int32 *)P2, 0xFFFFFF7F);
HIDWORD(v102) = 0;
while( *(char *)(P2 + 3) < 0 )
KeYieldProcessorEx((UINT64 *)((char *)&v102 + 4));
}
v31 = 0;
if( (KiVelocityFlags & 0x2000) != 0 )
{
if( *((_BYTE *)CurrentPrcb + 32)
|| ((v29 = *((_QWORD *)KeGetCurrentThread() + 23), (*(_DWORD *)(v29 + 1124) & 0x1000) == 0)
|| (*(_DWORD *)(v29 + 2172) & 0x4000000) != 0 ? (v30 = 0) : (v30 = 1),
!v30) )
{
v31 = 1;
}
}
*(_WORD *)(P2 + 58) = v31;
*(_QWORD *)(P2 + 48) = v27;
*(_DWORD *)(P2 + 60) = v95;
v120 = 0i64;
v121 = 0i64;
LODWORD(v120) = *(_DWORD *)P2;
v32 = BYTE1(v128);
BYTE1(v120) = BYTE1(v128);
if( v23 >= 0 )
{
BYTE1(v120) = BYTE1(v128) | 1;
v23 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart - v23;
if( v23 >= 0 )
{
*(_DWORD *)P2 = v120;
*(_QWORD *)(P2 + 24) = 0i64;
goto LABEL_58;
}
v32 = BYTE1(v120);
}
v33 = 0i64;
if( (v32 & 0xFC) != 0 )
v33 = (unsigned __int8)(v32 & 0xFC) << 16;
v34 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v23;
*(_QWORD *)(P2 + 24) = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v23;
BYTE3(v120) |= 0x40u;
BYTE2(v120) = (unsigned __int64)(v33 + v34) >> 18;
*(_DWORD *)P2 = v120;
*(_DWORD *)(P2 + 4) = 0;
if( KiInsertTimerTable(CurrentPrcb, (_KTIMER *)P2, Dpc, (unsigned __int8)((unsigned __int64)(v33 + v34) >> 18), 0i64) )
{
_InterlockedAnd((volatile signed __int32 *)P2, 0xFFFFFF7F);
goto LABEL_33;
}
LABEL_58:
KiTimerWaitTest(CurrentPrcb, (_KTIMER *)P2, 0i64);
LABEL_33:
KiExitDispatcher(CurrentPrcb, 0i64, AdjustUnwait, 0i64, v126);
v35 = v106;
v25 = v93;
v24 = Object;
if( v106 )
_interlockedbittestandset((volatile signed __int32 *)P2, 9u);
LABEL_35:
v36 = *(void **)(P2 + 256);
*(_QWORD *)(P2 + 256) = v35;
*(_BYTE *)(P2 + 304) ^= (*(_BYTE *)(P2 + 304) ^ (4 * a7)) & 4;
_InterlockedAnd64((volatile signed __int64 *)(P2 + 64), 0i64);
v37 = KeGetCurrentPrcb();
if( *((_QWORD *)v37 + 4247) && *((_BYTE *)v37 + 32) <= 1u && !v20 )
v24 = Object;
if( v25 )
KxReleaseSpinLock(v24 + 305);
__writecr8(CurrentIrql);
if( v94 )
{
if( v36 )
{
if( !v35 )
{
v87 = (_QWORD *)(P2 + 264);
v88 = *(_QWORD *)(P2 + 264);
v89 = *(_QWORD **)(P2 + 272);
if( *(_QWORD *)(v88 + 8) != P2 + 264 || (_QWORD *)*v89 != v87 )
goto LABEL_222;
*v89 = v88;
*(_QWORD *)(v88 + 8) = v89;
*v87 = 0i64;
}
LABEL_95:
v62 = _InterlockedExchangeAdd64((volatile signed __int64 *)&ExpWakeTimerLock, 0xFFFFFFFFFFFFFFFFui64);
if( (v62 & 2) != 0 && (v62 & 4) == 0 )
ExfTryToWakePushLock((volatile INT64 *)&ExpWakeTimerLock);
v104 = 0;
v63 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)&ExpWakeTimerLock) == 1 )
v64 = (unsigned int)MmGetSessionIdEx(*((_QWORD *)v63 + 23));
else
v64 = 0xFFFFFFFFi64;
--*((_WORD *)v63 + 243);
v65 = ++*((_BYTE *)v63 + 794);
v103 = 0;
v66 = 0i64;
v67 = (*((char *)v63 + 792) | *((char *)v63 + 870)) ^ 0x3F;
v59 = !_BitScanReverse((unsigned int *)&v68, v67);
v103 = v68;
if( !v59 )
{
while( 1 )
{
v67 &= ~(1 << v68);
v69 = *((_QWORD *)v63 + 100) + 96 * v68;
if( (*(_BYTE *)(v69 + 26) & 1) != 0
&& (*(_DWORD *)(v69 + 32) & 1) == 0
&& (*(_QWORD *)(v69 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&ExpWakeTimerLock & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v69 + 40) == (_DWORD)v64 )
{
*(_BYTE *)(v69 + 26) &= ~1u;
if( *(_QWORD *)(v69 + 32) )
break;
}
v59 = !_BitScanReverse((unsigned int *)&v68, v67);
v103 = v68;
if( v59 )
goto LABEL_105;
}
v66 = v69;
}
LABEL_105:
if( v66 )
{
*(_BYTE *)(v66 + 32) |= 2u;
if( *(__int64 *)(v66 + 32) < 0 )
KiAbEntryRemoveFromTree(v66);
v70 = *(_DWORD *)(v66 + 88);
v104 = v70 & 0x1FFFF;
*(_DWORD *)(v66 + 88) = v70 & 0xFFFE0000;
*(_BYTE *)(v66 + 25) &= ~1u;
*(_QWORD *)(v66 + 32) = 0i64;
v71 = 1 << ((__int64)(v66 - *((_QWORD *)v63 + 100)) / 96);
if( v65 == 1 )
*((_BYTE *)v63 + 792) |= v71;
else
_InterlockedOr8((volatile signed __int8 *)v63 + 870, v71);
}
else if( (*((_DWORD *)v63 + 30) & 0x10000) == 0 )
{
KeBugCheckEx(0x162u, (ULONG_PTR)v63, (ULONG_PTR)&ExpWakeTimerLock, v64, 0i64);
}
--*((_BYTE *)v63 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v63, (__int64)&ExpWakeTimerLock, (unsigned int *)&v104);
v59 = (*((_WORD *)v63 + 243))++ == 0xFFFF;
if( v59 && *((_ETHREAD **)v63 + 19) != (_ETHREAD *)((char *)v63 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegionThread((__int64)CurrentThread);
if( v36 )
PoDestroyReasonContext(v36);
goto LABEL_39;
}
if( !v35 )
goto LABEL_95;
v60 = (_QWORD *)(P2 + 264);
v61 = (_QWORD *)qword_140C16938;
if( *(__int64 **)qword_140C16938 == &ExpWakeTimerList )
{
*v60 = &ExpWakeTimerList;
*(_QWORD *)(P2 + 272) = v61;
*v61 = v60;
qword_140C16938 = P2 + 264;
goto LABEL_95;
}
LABEL_222:
__fastfail(3u);
}
LABEL_39:
if( v19 )
{
ObpTraceObjectDereferenceIfActive(P2 - 48, (_BYTE *)v19, 1953261124i64, (INT64)a4, BugCheckParameter4);
v38 = _InterlockedExchangeAdd64((volatile signed __int64 *)(P2 - 48), -v19) - v19;
if( v38 <= 0 )
{
if( *(_QWORD *)(P2 - 40) )
KeBugCheckEx(
0x18u,
ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(P2 - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)(P2 - 48) >> 8)],
P2,
6ui64,
*(_QWORD *)(P2 - 40));
if( v38 < 0 )
KeBugCheckEx(0x18u, 0i64, P2, 5ui64, v38);
ObpDeferObjectDeletion(P2 - 48);
}
}
v39 = v127;
if( !v127 )
return v96;
if( !a2 )
{
*v127 = v97;
return v96;
}
v90 = (__int64)v127;
if( (unsigned __int64)v127 >= 0x7FFFFFFF0000i64 )
v90 = 0x7FFFFFFF0000i64;
*(_BYTE *)v90 = *(_BYTE *)v90;
*v39 = v97;
return v96;
}Referenced by:
ExpSetTimer
NtSetTimerEx