ExGetWakeTimerList
NTSTATUS __stdcall ExGetWakeTimerList(PVOID *ReturnList, UINT64 *ReturnListLength){
UINT64 TimerDueTime;
UINT64 v3;
void *v4;
_ETHREAD *CurrentThread;
__int64 v6;
__int64 AbOrphanedEntrySummary;
char v8;
__int64 v9;
NTSTATUS SessionId;
UINT8 v11;
bool v12;
_QWORD *v13;
_DIAGNOSTIC_CONTEXT *v14;
char *PoolWithQuotaTag;
int v16;
char *v17;
void **v18;
UINT64 v19;
unsigned __int64 v20;
void **v21;
unsigned __int8 v22;
int v23;
UINT8 v24;
_DIAGNOSTIC_CONTEXT *v25;
UINT64 v26;
UINT64 *v27;
_ETHREAD *v28;
unsigned int v29;
unsigned __int8 v30;
int v31;
_KLOCK_ENTRY *v32;
__int64 v33;
int v34;
unsigned int v35;
__int64 v36;
UINT64 BufferSizePointer;
UINT64 v39;
void *v40;
int v41;
UINT64 a3;
void **v43;
UINT64 *SpinLock;
_DIAGNOSTIC_CONTEXT *Context;
_KTHREAD *Thread;
unsigned __int8 v49;
TimerDueTime = 0i64;
BufferSizePointer = 0i64;
v3 = 0i64;
Thread = (_ETHREAD *)KeGetCurrentThread();
v4 = 0i64;
--Thread->Tcb.KernelApcDisable;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
LODWORD(a3) = 0;
--CurrentThread->Tcb.SpecialApcDisable;
if( ++CurrentThread->Tcb.AbAllocationRegionCount != 1 )
KeBugCheckEx(
0x192u,
CurrentThread,
(char *)&WheapDeferredInternalLogsEventLock + 2912,
(PVOID)KeGetCurrentIrql(),
0i64);
LOBYTE(v6) = CurrentThread->Tcb.AbEntrySummary;
v41 = 0;
if( !(_BYTE)v6 )
{
if( !CurrentThread->Tcb.AbOrphanedEntrySummary )
{
v9 = 0i64;
goto LABEL_7;
}
AbOrphanedEntrySummary = CurrentThread->Tcb.AbOrphanedEntrySummary;
CurrentThread->Tcb.AbOrphanedEntrySummary = 0;
LOBYTE(v6) = AbOrphanedEntrySummary | CurrentThread->Tcb.AbEntrySummary;
}
v8 = v6;
_BitScanForward((unsigned int *)&v6, (unsigned __int8)v6);
v41 = v6;
CurrentThread->Tcb.AbEntrySummary = v8 & ~(1 << v6);
v9 = (__int64)&CurrentThread->Tcb.LockEntries[v6];
if( !v9 )
{
LABEL_7:
_interlockedbittestandset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 0x10u);
goto LABEL_14;
}
if( (unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912 >= 0xFFFF800000000000ui64
&& *((_BYTE *)&stru_140C4DB30
+ ((((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) >> 39) & 0x1FF)
+ 6872) == 1 )
{
SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
}
else
{
SessionId = -1;
}
*(_DWORD *)(v9 + 40) = SessionId;
*(_QWORD *)(v9 + 32) = ((unsigned __int64)&WheapDeferredInternalLogsEventLock + 2912) & 0x7FFFFFFFFFFFFFFCi64;
LABEL_14:
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, &a3);
v12 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v12
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
if( _interlockedbittestandset64((volatile signed __int32 *)&WheapDeferredInternalLogsEventLock + 728, 0i64) )
ExfAcquirePushLockExclusiveEx(
(_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364,
(VOID *)v9,
(char *)&WheapDeferredInternalLogsEventLock + 2912);
if( v9 )
*(_BYTE *)(v9 + 26) |= 1u;
v13 = (_QWORD *)*(&WheapDeferredInternalLogsEventLock + 366);
if( (_UNKNOWN *)*(&WheapDeferredInternalLogsEventLock + 366) != (_UNKNOWN *)((char *)&WheapDeferredInternalLogsEventLock
+ 2928) )
{
do
{
v14 = (_DIAGNOSTIC_CONTEXT *)*(v13 - 1);
if( v14 )
{
BufferSizePointer = 0i64;
PoStoreDiagnosticContext(v14, 0i64, &BufferSizePointer, v11);
v3 = (BufferSizePointer + 31 + v3) & 0xFFFFFFFFFFFFFFF8ui64;
if( v3 > 0xFFFFFFFF )
{
v16 = -1073741789;
goto LABEL_44;
}
}
v13 = (_QWORD *)*v13;
}
while( v13 != (_QWORD *)((char *)&WheapDeferredInternalLogsEventLock + 2928) );
if( v3 )
goto LABEL_27;
}
v3 = 64i64;
LABEL_27:
PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v3, 0x734C6B57ui64);
v40 = PoolWithQuotaTag;
v4 = PoolWithQuotaTag;
if( PoolWithQuotaTag )
{
v16 = 0;
v17 = PoolWithQuotaTag;
memset(PoolWithQuotaTag, 0i64, v3);
v18 = (void **)*(&WheapDeferredInternalLogsEventLock + 366);
v19 = 0i64;
BufferSizePointer = 0i64;
v20 = v3;
while( 1 )
{
v43 = v18;
if( v18 == (void **)((char *)&WheapDeferredInternalLogsEventLock + 2928) )
break;
if( v20 < 0x40 )
goto LABEL_48;
v21 = v18 - 33;
SpinLock = (UINT64 *)(v18 - 25);
v22 = KeAcquireSpinLockRaiseToDpc(SpinLock);
v23 = *((_DWORD *)v21 + 60);
v49 = v22;
Context = (_DIAGNOSTIC_CONTEXT *)v21[32];
HIDWORD(a3) = v23;
if( Context )
TimerDueTime = KeQueryTimerDueTime((_KTIMER *)v21);
else
TimerDueTime = 0i64;
KxReleaseSpinLock(SpinLock);
__writecr8(v49);
if( TimerDueTime )
{
v25 = Context;
v26 = TimerDueTime - *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
*((_DWORD *)v17 + 4) = HIDWORD(a3);
BufferSizePointer = v20 - 24;
*((_QWORD *)v17 + 1) = v26;
TimerDueTime = 0i64;
v16 = PoStoreDiagnosticContext(v25, (_DIAGNOSTIC_BUFFER *)(v17 + 24), &BufferSizePointer, v24);
if( v16 < 0 )
goto LABEL_43;
v19 = (BufferSizePointer + 31) & 0xFFFFFFFFFFFFFFF8ui64;
BufferSizePointer = v19;
if( v20 < v19 )
{
LABEL_48:
v16 = -1073741789;
goto LABEL_43;
}
v20 -= v19;
*(_QWORD *)v17 = v19;
v17 += v19;
}
v18 = (void **)*v43;
}
v27 = (UINT64 *)&v17[-v19];
*v27 = TimerDueTime;
if( !v19 )
v27[1] = TimerDueTime;
LABEL_43:
v4 = v40;
}
else
{
v16 = -1073741670;
}
LABEL_44:
if( (_InterlockedExchangeAdd64((_QWORD *)&WheapDeferredInternalLogsEventLock + 364, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 364);
v28 = (_ETHREAD *)KeGetCurrentThread();
LODWORD(v39) = TimerDueTime;
if( MiGetSystemRegionType((UINT64)&WheapDeferredInternalLogsEventLock + 2912) == 1 )
v29 = MmGetSessionIdEx(v28->Tcb.ApcState.Process);
else
v29 = -1;
--v28->Tcb.SpecialApcDisable;
v30 = ++v28->Tcb.AbAllocationRegionCount;
v31 = ((char)v28->Tcb.AbEntrySummary | (char)v28->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v12 = !_BitScanReverse((unsigned int *)&v33, v31);
if( v12 )
goto LABEL_57;
v32 = &v28->Tcb.LockEntries[v33];
v31 &= ~(1 << v33);
if( (v32->AcquiredByte & 1) != 0
&& (v32->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v32->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (((unsigned __int64)&WheapDeferredInternalLogsEventLock
+ 2912) & 0x7FFFFFFFFFFFFFFCi64)
&& v32->LockState.SessionId == v29 )
{
v32->AcquiredByte &= ~1u;
if( v32->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
}
if( !v32 )
{
LABEL_57:
if( (*(&v28->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v28, (char *)&WheapDeferredInternalLogsEventLock + 2912, (PVOID)v29, 0i64);
goto LABEL_64;
}
v32->CrossThreadReleasableAndBusyByte |= 2u;
if( v32->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v32);
v34 = v32->BoostBitmap.AllFields & 0x1FFFF;
v35 = v32->BoostBitmap.AllFields & 0xFFFE0000;
v32->ThreadLocalFlags &= ~1u;
LODWORD(v39) = v34;
v32->BoostBitmap.AllFields = v35;
v32->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v36 = v32 - v28->Tcb.LockEntries;
if( v30 == 1 )
v28->Tcb.AbEntrySummary |= 1 << v36;
else
_InterlockedOr8((volatile signed __int8 *)&v28->Tcb.AbOrphanedEntrySummary, 1 << v36);
LABEL_64:
--v28->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v28->Tcb, (char *)&WheapDeferredInternalLogsEventLock + 2912, &v39);
v12 = v28->Tcb.SpecialApcDisable++ == -1;
if( v12 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v28->Tcb.ApcState.ApcListHead[0].Flink != &v28->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegionThread(&Thread->Tcb);
if( v16 >= 0 )
{
*ReturnList = v4;
*(_DWORD *)ReturnListLength = v3;
}
else if( v4 )
{
ExFreeHeapPool(v4);
}
return v16;
}Referenced by:
NtPowerInformation