ExfWaitForRundownProtectionRelease

VOID __stdcall ExfWaitForRundownProtectionRelease(_EX_RUNDOWN_REF *RunRef, UINT64 Value){
  UINT64 v3; 
  bool v4; 
  UINT64 v5; 
  int v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  UINT64 v11; 
  __int128 Object; 
  __int64 v13; 
  __int64 v14[3]; 
  UINT64 SpinCount; 

  v14[0] = 1i64;
  v13 = 0i64;
  Object = 0i64;
  do
  {
    v3 = Value >> 1;
    v11 = Value >> 1;
    v5 = _InterlockedCompareExchange64((volatile signed __int64 *)RunRef, (signed __int64)&v11 + 1, Value);
    v4 = Value == v5;
    Value = v5;
  }
  while( !v4 );
  if( v3 )
  {
    LODWORD(SpinCount) = 0;
    if( KeGetCurrentIrql() >= 2u )
    {
      while( (v14[0] & 1) != 0 )
        KeYieldProcessorEx(&SpinCount);
    }
    else if( KUSER_SHARED_DATA.UnparkedProcessorCount <= 1u )
    {
LABEL_11:
      LOWORD(Object) = 1;
      v13 = (__int64)&Object + 8;
      *((_QWORD *)&Object + 1) = (char *)&Object + 8;
      BYTE2(Object) = 6;
      DWORD1(Object) = 0;
      if( _interlockedbittestandreset((volatile signed __int32 *)v14, 0) )
        KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
    }
    else if( KUSER_SHARED_DATA.ProcessorFeatures[35] )
    {
      v7 = __rdtsc();
      v8 = v7 + (unsigned int)ExpSpinCycleCount;
      while( 1 )
      {
        __asm { monitorx rax, rcx, rdx }
        if( (v14[0] & 1) == 0 )
          break;
        v9 = v7;
        v10 = __rdtsc();
        v7 = v10;
        if( v10 <= v9 || v10 >= v8 )
          goto LABEL_11;
        __asm { mwaitx  rax, rcx, rbx }
      }
    }
    else
    {
      v6 = 0;
      while( (v14[0] & 1) != 0 )
      {
        if( v6 == ExpSpinCycleCount / (unsigned int)KUSER_SHARED_DATA.CyclesPerYield )
          goto LABEL_11;
        _mm_pause();
        ++v6;
      }
    }
  }
}

Referenced by: