KiProcessExpiredTimerList

VOID __fastcall KiProcessExpiredTimerList(struct KPRCB *a1, INT64 *a2, INT64 a3, UINT64 a4){
  __int64 v4; 
  int v5; 
  unsigned int v8; 
  __int64 v9; 
  volatile signed __int32 *v10; 
  __int64 v11; 
  __int64 v12; 
  int v13; 
  ULONG_PTR v14; 
  __int64 v15; 
  INT64 v16; 
  void(__fastcall *v17)(__int64, _QWORD, _QWORD, _QWORD); 
  ULONG_PTR v18; 
  __int64 **v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 *v22; 
  __int64 *v23; 
  void *v24; 
  __int64 *v25; 
  __int64 **v26; 
  ULONG_PTR BugCheckParameter4; 
  ULONG_PTR BugCheckParameter2; 
  UINT64 SpinCount; 
  unsigned int v30; 
  __int64 v31; 
  INT64 v32; 
  __int128 v33; 
  __int128 v34; 
  LARGE_INTEGER v35[2]; 
  __int128 v36; 
  v4 = *((_QWORD *)a1 + 1);
  v30 = a4;
  v5 = BYTE4(PerfGlobalGroupMask) & 0x80;
  v31 = v4;
  BugCheckParameter2 = 0i64;
  v33 = 0i64;
  v32 = a3;
  v8 = 0;
  v34 = 0i64;
  *(_OWORD *)&v35[0].LowPart = 0i64;
  v36 = 0i64;
  HIDWORD(SpinCount) = *(_DWORD *)(v4 + 484);
  while( 1 )
  {
    v9 = v8++;
    v10 = (volatile signed __int32 *)_InterlockedExchange64((volatile __int64 *)(a3 + 8 * v9), 0i64);
    if( v10 )
    {
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset(v10, 7u) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( (*v10 & 0x80u) != 0 );
      }
      KiTimerWaitTest((_KPRCB *)a1, (_KTIMER *)v10, (_ULARGE_INTEGER *)(a2 + 1));
      v12 = v11;
      if( v11 )
      {
        if( *((_QWORD *)a1 + 1441) )
          KiProcessThreadWaitList(a1, 1, 0);
        if( v5 )
          EtwGetKernelTraceTimestamp(v35, 0x20000080ui64);
        v13 = *(_DWORD *)a2;
        BugCheckParameter2 = *(_QWORD *)(v12 + 24);
        v14 = BugCheckParameter2;
        *(_DWORD *)a2 = v13 + 1;
        v15 = 2 * ((v13 & 0xF) + 1i64);
        a2[v15] = v14;
        LODWORD(a2[v15 + 1]) = KUSER_SHARED_DATA.TickCount.LowPart;
        v16 = *((_QWORD *)a1 + 4245);
        *((_DWORD *)a1 + 8103) = 0;
        if( v16 && *((_QWORD *)a1 + 4246) != v16 && *((_DWORD *)a1 + 7931) < *((_DWORD *)a1 + 7933) )
        {
          *((_QWORD *)a1 + 4246) = v16;
          memset(v16, 0i64);
        }
        v17 = (void(__fastcall *)(__int64, _QWORD, _QWORD, _QWORD))BugCheckParameter2;
        *((_BYTE *)a1 + 12586) = 1;
        v17(v12, *(_QWORD *)(v12 + 32), *((unsigned int *)a2 + 2), *((unsigned int *)a2 + 3));
        v18 = HIDWORD(SpinCount);
        *((_BYTE *)a1 + 12586) = 0;
        HIDWORD(a2[v15 + 1]) = KUSER_SHARED_DATA.TickCount.LowPart;
        if( (_DWORD)v18 != *(_DWORD *)(v31 + 484) )
          KeBugCheckEx(0xC7u, 5ui64, BugCheckParameter2, v18, *(unsigned int *)(v31 + 484));
        if( v5 )
        {
          LODWORD(BugCheckParameter4) = 4196866;
          EtwTraceTimedEvent(3909, 0x20000080ui64, (INT64)&BugCheckParameter2, 8i64, BugCheckParameter4, (INT64)v35);
        }
      }
    }
    if( v8 >= v30 )
      break;
    a3 = v32;
  }
  v19 = (__int64 **)*((_QWORD *)a1 + 1441);
  if( v19 )
  {
    *((_QWORD *)a1 + 1441) = 0i64;
    do
    {
      v20 = *((unsigned __int8 *)v19 + 371);
      v21 = (__int64)(v19 - 27);
      v22 = *(v19 - 1);
      v19 = (__int64 **)*v19;
      v23 = &v22[6 * v20];
      do
      {
        if( *((_BYTE *)v22 + 17) < 5u )
        {
          v24 = (void *)v22[4];
          KiAcquireKobjectLockSafe(v24);
          if( *((_BYTE *)v22 + 17) == 4 )
          {
            v25 = (__int64 *)*v22;
            if( *(__int64 **)(*v22 + 8) != v22 || (v26 = (__int64 **)v22[1], *v26 != v22) )
              __fastfail(3u);
            *v26 = v25;
            v25[1] = (__int64)v26;
          }
          _InterlockedAnd((volatile signed __int32 *)v24, 0xFFFFFF7F);
        }
        v22 += 6;
      }
      while( v22 != v23 );
      *(_WORD *)(v21 + 566) = 1;
      KiReadyThread((struct _KPRCB *)a1, v21);
    }
    while( v19 );
  }
}

Referenced by: