KiDecrementProcessStackCount
VOID __stdcall KiDecrementProcessStackCount(_EPROCESS *Process){
char v2;
unsigned __int8 CurrentIrql;
unsigned __int32 v4;
unsigned __int32 v5;
signed __int64 *v6;
signed __int64 v7;
signed __int64 v8;
if( (_InterlockedExchangeAdd((volatile signed __int32 *)Process + 210, 0xFFFFFFF8) & 0xFFFFFFF8) == 8 )
{
v2 = 0;
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
KiAcquireKobjectLockSafe(Process);
v4 = *((_DWORD *)Process + 210);
if( (v4 & 7) == 0 && *((_EPROCESS **)Process + 6) != (_EPROCESS *)((char *)Process + 48) )
{
while( v4 < 8 )
{
v5 = v4;
v4 = _InterlockedCompareExchange((volatile signed __int32 *)Process + 210, v4 & 0xFFFFFFF8 | 3, v4);
if( v5 == v4 )
{
v2 = 1;
break;
}
}
}
_InterlockedAnd((volatile signed __int32 *)Process, 0xFFFFFF7F);
if( v2 )
{
v6 = (signed __int64 *)((char *)Process + 360);
_m_prefetchw(&KiProcessOutSwapListHead);
v7 = KiProcessOutSwapListHead;
do
{
*v6 = v7;
v8 = v7;
v7 = _InterlockedCompareExchange64(&KiProcessOutSwapListHead, (signed __int64)v6, v7);
}
while( v7 != v8 );
if( !v7 )
KeSetEvent(&KiSwapEvent, 10);
}
__writecr8(CurrentIrql);
}
}Referenced by:
KeDeleteThread
KiCommitThreadWait
KiOutSwapKernelStacks
KiSuspendThread
KiUnstackDetachProcess