ExQuerySystemLockInformation

INT64 __fastcall ExQuerySystemLockInformation(_DWORD *a1, UINT64 a2, UINT64 *a3){
  unsigned int v3; 
  unsigned int v5; 
  unsigned int v7; 
  _DWORD *v8; 
  KIRQL v9; 
  INT64(__fastcall *v10)(INT64 *, UINT64 *); 
  INT64(__fastcall *v11)(INT64 *, UINT64 *); 
  unsigned __int64 v12; 
  __int64 v13; 
  __int64 v14; 
  INT64 v15; 
  v3 = 8;
  v5 = a2;
  if( (unsigned int)a2 >= 8 )
  {
    *a1 = 0;
    v8 = a1 + 2;
    v7 = 0;
    MmLockPagableSectionByHandle(ExPageLockHandle);
    v9 = ExAcquireSpinLockShared(&ExpResourceSpinLock);
    v10 = *(INT64(__fastcall **)(INT64 *, UINT64 *))ExpSystemResourcesList;
    v11 = ExpSystemResourcesList;
    v12 = v9;
    while( v10 != v11 )
    {
      ++*a1;
      v3 += 48;
      if( v3 < 0x30 )
      {
        v7 = -1073741675;
        break;
      }
      if( v5 >= v3 )
      {
        *(_QWORD *)v8 = v10;
        v8[2] = 1;
        v13 = ExpOwnerEntryToThread((__int64 *)v10 + 6);
        if( v13 )
          v14 = *(_QWORD *)(v13 + 1152);
        else
          v14 = 0i64;
        *((_QWORD *)v8 + 2) = v14;
        v8[6] = *((_DWORD *)v10 + 16);
        v8[7] = *((_DWORD *)v10 + 17);
        v8[10] = *((_DWORD *)v10 + 18);
        v8[11] = *((_DWORD *)v10 + 19);
        v8 += 12;
      }
      else
      {
        v7 = -1073741820;
      }
      v10 = *(INT64(__fastcall **)(INT64 *, UINT64 *))v10;
    }
    ExReleaseSpinLockSharedFromDpcLevel(&ExpResourceSpinLock);
    __writecr8(v12);
    MmUnlockPagableImageSection(ExPageLockHandle, v15);
  }
  else
  {
    v7 = -1073741820;
  }
  if( a3 )
    *(_DWORD *)a3 = v3;
  return v7;
}

Referenced by: