IopKeepAliveWorker

VOID __stdcall IopKeepAliveWorker(PVOID StartContext){
  UINT64 v1; 
  unsigned __int8 v2; 
  unsigned __int8 v3; 
  PVOID v4; 
  int v5; 
  PVOID v6; 
  PVOID *v7; 
  bool v8; 
  UINT64 v9; 
  UINT64 v10; 
  __int64 v11; 
  char v12; 
  _DWORD *v13; 
  int v14; 
  unsigned __int8 v15; 
  unsigned __int64 v16; 
  BOOL v17; 
  KeAcquireSpinLockRaiseToDpc(&qword_140C45BF0, v1);
  qword_140C45C20 = (__int64)KeGetCurrentThread();
LABEL_2:
  v3 = v2;
  while( 1 )
  {
    v4 = qword_140C45BE0;
    if( qword_140C45BE0 == &qword_140C45BE0 )
      break;
    v5 = *((_DWORD *)qword_140C45BE0 + 8);
    *((_DWORD *)qword_140C45BE0 + 8) = 0;
    if( v5 )
    {
      KxReleaseSpinLock(&qword_140C45BF0);
      __writecr8(v3);
      if( v5 > 0 )
      {
        do
        {
          ObfReferenceObjectWithTag(*((PVOID *)v4 + 3), 0x746C6644u);
          PspAdjustKeepAliveCountProcess(*((void **)v4 + 3), 1, *((_QWORD *)v4 + 5), *((_BYTE *)v4 + 18));
          --v5;
        }
        while( v5 );
        goto LABEL_23;
      }
      if( v5 != -1 )
      {
        v11 = (unsigned int)(-1 - v5);
        do
        {
          PspAdjustKeepAliveCountProcess(*((void **)v4 + 3), -1, *((_QWORD *)v4 + 5), *((_BYTE *)v4 + 18));
          ObfDereferenceObjectWithTag(*((PVOID *)v4 + 3), 0x746C6644ui64);
          --v11;
        }
        while( v11 );
      }
      v12 = *((_BYTE *)v4 + 18);
      v13 = (_DWORD *)*((_QWORD *)v4 + 3);
      if( v12 )
        v14 = v13[619];
      else
        v14 = v13[627];
      if( (v14 & 0x7FFFFFFF) == 1 )
      {
        KeAcquireSpinLockRaiseToDpc(&qword_140C45BF0, v9);
        v16 = v15;
        if( *(__int64 *)&KUSER_SHARED_DATA.SystemTime.LowPart >= *((_QWORD *)v4 + 6) )
        {
          KxReleaseSpinLock(&qword_140C45BF0);
          __writecr8(v16);
          v12 = *((_BYTE *)v4 + 18);
          v13 = (_DWORD *)*((_QWORD *)v4 + 3);
          goto LABEL_21;
        }
        --*((_DWORD *)v4 + 8);
        KxReleaseSpinLock(&qword_140C45BF0);
        __writecr8(v16);
        LOBYTE(v17) = 1;
        KeDelayExecutionThread(0, v17, (PLARGE_INTEGER)v4 + 6);
      }
      else
      {
LABEL_21:
        PspAdjustKeepAliveCountProcess(v13, -1, *((_QWORD *)v4 + 5), v12);
        ObfDereferenceObjectWithTag(*((PVOID *)v4 + 3), 0x746C6644ui64);
      }
LABEL_23:
      KeAcquireSpinLockRaiseToDpc(&qword_140C45BF0, v10);
      goto LABEL_2;
    }
    v6 = *(PVOID *)v4;
    v7 = (PVOID *)*((_QWORD *)v4 + 1);
    if( *(PVOID *)(*(_QWORD *)v4 + 8i64) != v4 || *v7 != v4 )
      __fastfail(3u);
    *v7 = v6;
    *((_QWORD *)v6 + 1) = v7;
    v8 = *((_BYTE *)v4 + 17) == 1;
    *((_BYTE *)v4 + 16) = 0;
    if( v8 )
      ExFreePoolWithTag(v4, 0);
  }
  qword_140C45C20 = 0i64;
  byte_140C45C18 = 0;
  KxReleaseSpinLock(&qword_140C45BF0);
  __writecr8(v3);
}

Referenced by: