PopIdleWakeFinalizeWakeSource

NTSTATUS __fastcall PopIdleWakeFinalizeWakeSource(INT64 a1, INT64 a2){
  wchar_t *v3; 
  wchar_t *v4; 
  WCHAR *v5; 
  NTSTATUS result; 
  if( (_DWORD)a1 == 6 && *(_BYTE *)a2 == 3 )
  {
    v3 = 0i64;
    if( PopTimeBrokerExpirationDueTime
      && *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart >= (unsigned __int64)PopTimeBrokerExpirationDueTime )
    {
      v4 = &PopTimeBrokerExpirationReason;
      if( (unsigned __int64)(PopTimeBrokerExpirationDueTime + 20000000) < *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart )
        v4 = 0i64;
      v3 = v4;
    }
    v5 = (WCHAR *)L"Unknown";
    if( v3 )
      v5 = v3;
    return RtlStringCbCopyW((PWCHAR)(a2 + 2), 0x80ui64, v5);
  }
  return result;
}

Referenced by: