KeQueryWakeSource

NTSTATUS __stdcall KeQueryWakeSource(INT64 *a1, _BYTE *a2){
  NTSTATUS result; 
  unsigned __int8 CurrentIrql; 
  struct _KPRCB *CurrentPrcb; 
  _QWORD *v7; 
  __int64 v8; 
  _QWORD *v9; 
  __int64 v10; 
  __int64 v11; 
  UINT64 v12; 
  int v13; 
  unsigned int v14; 
  INT64 CurrentQpc; 
  char v16; 
  char v17; 

  v14 = 0;
  CurrentQpc = 0i64;
  v16 = 0;
  v17 = 0;
  memset(a2, 0i64, 0x88u);
  result = ((__int64(__fastcall *)(unsigned int *, _QWORD))off_140C008E8[0])(&v14, 0i64);
  if( result >= 0 )
  {
    if( ((v14 - 209) & 0xFFFFFFFD) != 0 )
    {
      *(_DWORD *)a1 = 5;
      CurrentIrql = KeGetCurrentIrql();
      __writecr8(0xFui64);
      if( v14 <= 0xFF
        && (_mm_lfence(), CurrentPrcb = KeGetCurrentPrcb(), (v7 = CurrentPrcb->InterruptObject[v14]) != 0i64) )
      {
        v8 = 0i64;
        v9 = CurrentPrcb->InterruptObject[v14];
        do
        {
          v10 = v9[4];
          if( v10 || (v10 = v9[3]) != 0 )
            *(_QWORD *)&a2[8 * v8] = v10;
          v11 = v9[1];
          v8 = (unsigned int)(v8 + 1);
          if( !v11 )
            break;
          v9 = (_QWORD *)(v11 - 8);
          if( v9 == v7 )
            break;
        }
        while( (unsigned int)v8 < 3 );
      }
      else
      {
        *(_DWORD *)a1 = 2;
      }
      __writecr8(CurrentIrql);
    }
    else
    {
      LODWORD(v12) = RtlGetInterruptTimePrecise(&CurrentQpc);
      if( KiGetPastDueIRTimerInfo(v12, &v16, &v17) )
      {
        v13 = 6;
        *a2 = v16;
        a2[2] = v17;
      }
      else
      {
        v13 = 1;
      }
      *(_DWORD *)a1 = v13;
    }
  }
  else
  {
    if( result != -1073741823 )
      return result;
    *(_DWORD *)a1 = 0;
  }
  return 0;
}

Referenced by: