KeReleaseMutant

NTSTATUS __stdcall KeReleaseMutant(_KMUTANT *Mutant, INT64 Increment, UINT8 Abandoned, UINT8 Wait){
  unsigned int v4; 
  _ETHREAD *CurrentThread; 
  int v8; 
  _ETHREAD *OwnerThread; 
  char v10; 
  __int64 CurrentIrql; 
  struct _KPRCB *CurrentPrcb; 
  NTSTATUS v13; 
  int v14; 
  int v15; 
  struct _KPRCB *v16; 
  _LIST_ENTRY *Flink; 
  _LIST_ENTRY *Blink; 
  _KMUTANT *v19; 
  _ETHREAD *v20; 
  __int64 v22; 
  _KWAIT_BLOCK *v23; 
  _KWAIT_BLOCK **v24; 
  unsigned __int8 WaitType; 
  bool v26; 
  char v27; 
  NTSTATUS v28; 
  _DWORD *SchedulerAssist; 
  _QWORD *v30; 
  _KQUEUE *v31; 
  char v32; 
  int v33; 
  INT64 *v34; 
  INT64 v35; 
  _SINGLE_LIST_ENTRY *Next; 
  unsigned int SessionId; 
  _ETHREAD *Thread; 
  _KQUEUE *Object; 
  _KPRCB *Prcb; 
  UINT64 SpinCount; 
  INT64 Entry; 
  __int64 OldIrql; 
  _QWORD *v44; 
  _KPRCB *v45; 
  _KTHREAD *WakeThread; 
  _ETHREAD *v47; 
  __int128 v48; 
  __int64 v49; 
  UINT64 v50; 
  INT64 Incrementa; 
  int ApcDisable; 
  UINT8 v53; 

  v53 = Wait;
  LODWORD(Incrementa) = Increment;
  v4 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Thread = CurrentThread;
  v8 = 0;
  OwnerThread = 0i64;
  WakeThread = 0i64;
  v10 = 0;
  CurrentIrql = KeGetCurrentIrql();
  OldIrql = CurrentIrql;
  __writecr8(2ui64);
  CurrentPrcb = KeGetCurrentPrcb();
  LODWORD(v50) = 0;
  Prcb = CurrentPrcb;
  if( _interlockedbittestandset((volatile signed __int32 *)Mutant, 7u) )
  {
    do
    {
      do
        KeYieldProcessorEx(&v50);
      while( (*(_DWORD *)Mutant->gap0 & 0x80u) != 0 );
    }
    while( _interlockedbittestandset((volatile signed __int32 *)Mutant, 7u) );
    CurrentThread = Thread;
    LOBYTE(CurrentIrql) = OldIrql;
  }
  v13 = *(_DWORD *)&Mutant->gap0[4];
  if( Abandoned )
  {
    Mutant->MutantFlags |= 1u;
    v14 = 1;
    *(_DWORD *)&Mutant->gap0[4] = 1;
  }
  else
  {
    if( Mutant->OwnerThread != CurrentThread || Mutant->gap0[2] != CurrentPrcb->DpcRoutineActive )
    {
      v27 = Mutant->MutantFlags & 1;
      _InterlockedAnd((volatile signed __int32 *)Mutant, 0xFFFFFF7F);
      __writecr8((unsigned __int8)CurrentIrql);
      if( v27 )
        v28 = 128;
      else
        v28 = -1073741754;
      RtlRaiseStatus(v28);
    }
    v14 = ++*(_DWORD *)&Mutant->gap0[4];
  }
  if( v14 != 1 || v13 > 0 )
  {
    _InterlockedAnd((volatile signed __int32 *)Mutant, 0xFFFFFF7F);
    v20 = Thread;
    goto LABEL_19;
  }
  v49 = 0i64;
  v15 = *(_DWORD *)Mutant->gap0;
  v48 = 0i64;
  LODWORD(v48) = v15;
  BYTE2(v48) = 0;
  *(_DWORD *)Mutant->gap0 = v48;
  v16 = KeGetCurrentPrcb();
  OwnerThread = Mutant->OwnerThread;
  ApcDisable = Mutant->ApcDisable;
  LODWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)&OwnerThread->Tcb.ThreadLock, 0i64) )
  {
    do
      KeYieldProcessorEx(&SpinCount);
    while( OwnerThread->Tcb.ThreadLock );
    SchedulerAssist = v16->SchedulerAssist;
    if( SchedulerAssist && v16->NestingLevel <= 1u )
      ++SchedulerAssist[6];
  }
  Flink = Mutant->MutantListEntry.Flink;
  Blink = Mutant->MutantListEntry.Blink;
  if( Flink->Blink != &Mutant->MutantListEntry || Blink->Flink != &Mutant->MutantListEntry )
LABEL_27:
    __fastfail(3u);
  Blink->Flink = Flink;
  Flink->Blink = Blink;
  OwnerThread->Tcb.ThreadLock = 0i64;
  v19 = *(_KMUTANT **)&Mutant->gap0[8];
  Mutant->OwnerThread = 0i64;
  if( v19 != (_KMUTANT *)&Mutant->gap0[8] )
  {
    while( 1 )
    {
      v22 = *(_QWORD *)v19->gap0;
      v23 = (_KWAIT_BLOCK *)v19;
      Entry = (INT64)v19;
      v19 = (_KMUTANT *)v22;
      v24 = *(_KWAIT_BLOCK ***)(Entry + 8);
      if( *(_QWORD *)(v22 + 8) != Entry || *v24 != v23 )
        goto LABEL_27;
      *v24 = (_KWAIT_BLOCK *)v22;
      *(_QWORD *)(v22 + 8) = v24;
      WaitType = v23->WaitType;
      if( WaitType != 1 )
        break;
      if( KiTryUnwaitThread(Prcb, v23, v23->WaitKey, (_KTHREAD **)&WakeThread) )
      {
        v26 = (*(_DWORD *)&Mutant->gap0[4])-- == 1;
        if( v26 )
          goto LABEL_13;
      }
LABEL_44:
      if( v19 == (_KMUTANT *)&Mutant->gap0[8] )
        goto LABEL_13;
    }
    if( WaitType != 2 )
    {
      KiTryUnwaitThread(Prcb, v23, 256i64, 0i64);
      goto LABEL_44;
    }
    v23->BlockState = 5;
    Object = v23->NotificationQueue;
    v44 = (_QWORD *)((char *)Object + 8);
    v23->WaitListEntry.Flink = 0i64;
    KeGetCurrentIrql();
    __writecr8(2ui64);
    v45 = KeGetCurrentPrcb();
    v47 = v45->CurrentThread;
    KiAcquireKobjectLockSafe(Object);
    v30 = v44;
    v31 = Object;
    if( (_QWORD *)*v30 != v30
      && *((_DWORD *)Object + 10) < *((_DWORD *)Object + 11)
      && ((_KQUEUE *)v47->Tcb.Queue != Object || v47->Tcb.WaitReason != 15) )
    {
      KiWakeQueueWaiter(v45, Object, Entry);
      v31 = Object;
      if( v32 )
        goto LABEL_59;
      v30 = v44;
    }
    v33 = *((_DWORD *)v31 + 1);
    *((_DWORD *)v31 + 1) = v33 + 1;
    v34 = (INT64 *)*((_QWORD *)v31 + 4);
    if( (_KQUEUE *)*v34 != (_KQUEUE *)((char *)v31 + 24) )
      goto LABEL_27;
    v35 = Entry;
    *(_QWORD *)Entry = (char *)v31 + 24;
    *(_QWORD *)(v35 + 8) = v34;
    *v34 = v35;
    *((_QWORD *)v31 + 4) = v35;
    if( !v33 && (_QWORD *)*v30 != v30 )
    {
      KiWakeOtherQueueWaiters(v45, v31);
      v31 = Object;
    }
LABEL_59:
    _InterlockedAnd((volatile signed __int32 *)v31, 0xFFFFFF7F);
    v26 = (*(_DWORD *)&Mutant->gap0[4])-- == 1;
    if( v26 )
      goto LABEL_13;
    goto LABEL_44;
  }
LABEL_13:
  if( (Mutant->MutantFlags & 2) != 0 )
    v10 = 1;
  _InterlockedAnd((volatile signed __int32 *)Mutant, 0xFFFFFF7F);
  if( Abandoned )
    KiAcquireReleaseObjectRundownLockExclusive(Mutant);
  CurrentPrcb = Prcb;
  v20 = Thread;
  if( v10 )
  {
    if( WakeThread )
    {
      Next = Prcb->DeferredReadyListHead.Next;
      if( Next )
      {
        if( WakeThread == (_ETHREAD *)&Next[-27] )
          KeAbPreWakeupThread(&WakeThread->Tcb, Mutant, (unsigned int)Thread->Tcb.Priority);
      }
    }
  }
  v8 = ApcDisable;
LABEL_19:
  if( v53 )
    v4 = 3;
  KiExitDispatcher(CurrentPrcb, v4, AdjustUnwait, (unsigned int)Incrementa, OldIrql);
  if( v10 )
  {
    if( OwnerThread != v20 )
    {
      SessionId = MmGetSessionIdEx(v20->Tcb.ApcState.Process);
      KeBugCheckEx(0x162u, v20, Mutant, (PVOID)SessionId, (PVOID)1);
    }
    KeAbPostRelease(Mutant);
  }
  if( v8 )
    KeLeaveCriticalRegionThread(&v20->Tcb);
  return v13;
}

Referenced by: