NtCancelTimer
NTSTATUS __stdcall NtCancelTimer(PVOID TimerHandle, UINT8 *CurrentState){
KPROCESSOR_MODE v4;
int v5;
char *v6;
_OBJECT_TYPE *v7;
UINT64 *v8;
KTIMER *v9;
void *v10;
unsigned int v11;
int v12;
signed __int64 v13;
_ETHREAD *v15;
__int64 v16;
char v17;
__int64 v18;
int SessionId;
UINT64 v20;
__int64 v21;
bool v22;
unsigned __int8 v23;
_QWORD *v24;
__int64 v25;
_QWORD *v26;
char v27;
unsigned int v28;
ULONG_PTR v29;
unsigned __int64 v30;
int v31;
__int64 v32;
__int64 v33;
int v34;
unsigned __int8 v35;
__int64 v36;
__int64 v37;
unsigned __int8 BugCheckParameter1;
_ETHREAD *BugCheckParameter1a;
PVOID Object;
_ETHREAD *v41;
int v42;
unsigned int v43[3];
_ETHREAD *CurrentThread;
void *v45;
unsigned __int64 v46;
char v47;
_BYTE *v48;
char v49;
int v50;
v4 = *((_BYTE *)KeGetCurrentThread() + 562);
if( CurrentState && v4 )
{
v36 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)CurrentState < 0x7FFFFFFF0000i64 )
v36 = (__int64)CurrentState;
*(_BYTE *)v36 = *(_BYTE *)v36;
}
Object = 0i64;
v5 = ObReferenceObjectByHandle(TimerHandle, 2u, 0i64, v4, &Object, 0i64);
v43[1] = v5;
if( v5 < 0 )
return v5;
v6 = (char *)Object - 48;
v7 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
if( v7 == ExpIRTimerObjectType )
{
if( CurrentState )
{
ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
return -1073741811;
}
else
{
return ExpSetTimerObject2(Object);
}
}
else
{
if( v7 == ExTimerObjectType )
{
CurrentThread = 0i64;
v47 = 0;
v8 = (UINT64 *)((char *)Object + 64);
BugCheckParameter1 = KeGetCurrentIrql();
__writecr8(2ui64);
if( _interlockedbittestandset64((volatile signed __int32 *)v8, 0i64) )
KxWaitForSpinLockAndAcquire(v8);
v9 = (KTIMER *)Object;
v10 = (void *)*((_QWORD *)Object + 32);
v45 = v10;
if( !v10 )
goto LABEL_8;
KxReleaseSpinLock(v8);
__writecr8(BugCheckParameter1);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v43[0] = 0;
v15 = (_ETHREAD *)KeGetCurrentThread();
v41 = v15;
--*((_WORD *)v15 + 243);
if( ++*((_BYTE *)v15 + 794) != 1 )
KeBugCheckEx(0x192u, (ULONG_PTR)v15, (ULONG_PTR)&ExpWakeTimerLock, KeGetCurrentIrql(), 0i64);
v42 = 0;
LOBYTE(v16) = *((_BYTE *)v15 + 792);
if( !(_BYTE)v16 )
{
if( !*((_BYTE *)v15 + 870) )
{
v18 = 0i64;
v48 = 0i64;
goto LABEL_20;
}
v37 = *((unsigned __int8 *)v15 + 870);
*((_BYTE *)v15 + 870) = 0;
LOBYTE(v16) = v37 | *((_BYTE *)v15 + 792);
}
v17 = v16;
_BitScanForward((unsigned int *)&v16, (unsigned __int8)v16);
v42 = v16;
*((_BYTE *)v15 + 792) = v17 & ~(1 << v16);
v18 = *((_QWORD *)v15 + 100) + 96 * v16;
v48 = (_BYTE *)v18;
LABEL_20:
if( v18 )
{
if( (unsigned __int64)&ExpWakeTimerLock >= 0xFFFF800000000000ui64
&& *((_BYTE *)&antNameB + (((unsigned __int64)&ExpWakeTimerLock >> 39) & 0x1FF) - 256) == 1 )
{
SessionId = MmGetSessionIdEx(*((_QWORD *)v15 + 23));
v15 = v41;
v18 = (__int64)v48;
}
else
{
SessionId = -1;
}
*(_DWORD *)(v18 + 40) = SessionId;
*(_QWORD *)(v18 + 32) = (unsigned __int64)&ExpWakeTimerLock & 0x7FFFFFFFFFFFFFFCi64;
}
else
{
_interlockedbittestandset((volatile signed __int32 *)v15 + 30, 0x10u);
}
--*((_BYTE *)v15 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v15, (__int64)&ExpWakeTimerLock, v43);
v21 = (__int64)v41;
v22 = (*((_WORD *)v41 + 243))++ == 0xFFFF;
if( v22 && *(_QWORD *)(v21 + 152) != v21 + 152 )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)&ExpWakeTimerLock, 0i64) )
ExfAcquirePushLockExclusiveEx(&ExpWakeTimerLock, v48, &ExpWakeTimerLock);
if( v48 )
v48[26] |= 1u;
v47 = 1;
KeAcquireSpinLockRaiseToDpc(v8, v20);
BugCheckParameter1 = v23;
v10 = (void *)*((_QWORD *)v9 + 32);
v45 = v10;
*((_QWORD *)v9 + 32) = 0i64;
v9 = (KTIMER *)Object;
LABEL_8:
v11 = ExpCancelTimer(v9) + 1;
_InterlockedAnd64((volatile signed __int64 *)v8, 0i64);
__writecr8(BugCheckParameter1);
if( v47 )
{
if( v10 )
{
v24 = (char *)Object + 264;
v25 = *((_QWORD *)Object + 33);
v26 = (_QWORD *)*((_QWORD *)Object + 34);
if( *(PVOID *)(v25 + 8) != (char *)Object + 264 || (_QWORD *)*v26 != v24 )
__fastfail(3u);
*v26 = v25;
*(_QWORD *)(v25 + 8) = v26;
*v24 = 0i64;
}
v27 = _InterlockedExchangeAdd64((volatile signed __int64 *)&ExpWakeTimerLock, 0xFFFFFFFFFFFFFFFFui64);
if( (v27 & 2) != 0 && (v27 & 4) == 0 )
ExfTryToWakePushLock((volatile INT64 *)&ExpWakeTimerLock);
v50 = 0;
BugCheckParameter1a = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)&ExpWakeTimerLock) == 1 )
v28 = MmGetSessionIdEx(*((_QWORD *)BugCheckParameter1a + 23));
else
v28 = -1;
v29 = (ULONG_PTR)BugCheckParameter1a;
--*((_WORD *)BugCheckParameter1a + 243);
v49 = ++*((_BYTE *)BugCheckParameter1a + 794);
v30 = 0i64;
v41 = 0i64;
v46 = (unsigned __int64)&ExpWakeTimerLock & 0x7FFFFFFFFFFFFFFCi64;
v31 = (*((char *)BugCheckParameter1a + 792) | *((char *)BugCheckParameter1a + 870)) ^ 0x3F;
v22 = !_BitScanReverse((unsigned int *)&v32, v31);
if( !v22 )
{
while( 1 )
{
v31 &= ~(1 << v32);
v33 = *((_QWORD *)BugCheckParameter1a + 100) + 96 * v32;
if( (*(_BYTE *)(v33 + 26) & 1) != 0
&& (*(_DWORD *)(v33 + 32) & 1) == 0
&& (*(_QWORD *)(v33 + 32) & 0x7FFFFFFFFFFFFFFCi64) == v46
&& *(_DWORD *)(v33 + 40) == v28 )
{
*(_BYTE *)(v33 + 26) &= ~1u;
if( *(_QWORD *)(v33 + 32) )
break;
}
v22 = !_BitScanReverse((unsigned int *)&v32, v31);
if( v22 )
goto LABEL_47;
}
v30 = v33;
v41 = (_ETHREAD *)v33;
}
LABEL_47:
if( v30 )
{
*(_BYTE *)(v30 + 32) |= 2u;
if( *(__int64 *)(v30 + 32) < 0 )
{
KiAbEntryRemoveFromTree(v30);
v29 = (ULONG_PTR)BugCheckParameter1a;
v30 = (unsigned __int64)v41;
}
v34 = *(_DWORD *)(v30 + 88);
v50 = v34 & 0x1FFFF;
*(_DWORD *)(v30 + 88) = v34 & 0xFFFE0000;
*(_BYTE *)(v30 + 25) &= ~1u;
*(_QWORD *)(v30 + 32) = 0i64;
v35 = 1 << ((__int64)(v30 - *(_QWORD *)(v29 + 800)) / 96);
if( v49 == 1 )
*(_BYTE *)(v29 + 792) |= v35;
else
_InterlockedOr8((volatile signed __int8 *)(v29 + 870), v35);
}
else if( (*((_DWORD *)BugCheckParameter1a + 30) & 0x10000) == 0 )
{
KeBugCheckEx(0x162u, (ULONG_PTR)BugCheckParameter1a, (ULONG_PTR)&ExpWakeTimerLock, v28, 0i64);
}
--*(_BYTE *)(v29 + 794);
KiAbThreadRemoveBoosts(v29, (__int64)&ExpWakeTimerLock, (unsigned int *)&v50);
v22 = (*((_WORD *)BugCheckParameter1a + 243))++ == 0xFFFF;
if( v22 && *((_ETHREAD **)BugCheckParameter1a + 19) != (_ETHREAD *)((char *)BugCheckParameter1a + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegionThread((__int64)CurrentThread);
}
v12 = *((_DWORD *)Object + 1);
if( ObpTraceFlags )
ObpPushStackInfo((INT64)v6, 0, v11, 1953261124i64);
v13 = _InterlockedExchangeAdd64((volatile signed __int64 *)v6, -v11) - (int)v11;
if( v13 <= 0 )
{
if( *((_QWORD *)v6 + 1) )
KeBugCheckEx(
0x18u,
ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)v6[24] ^ (unsigned __int64)BYTE1(v6)],
(ULONG_PTR)Object,
6ui64,
*((_QWORD *)v6 + 1));
if( v13 < 0 )
KeBugCheckEx(0x18u, 0i64, (ULONG_PTR)Object, 5ui64, v13);
ObpDeferObjectDeletion((INT64)v6);
}
if( CurrentState )
*CurrentState = v12;
if( v10 )
PoDestroyReasonContext(v10);
return v5;
}
ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
return -1073741788;
}
}Referenced by:
No references.