FsRtlCancellableWaitForMultipleObjects
NTSTATUS __stdcall FsRtlCancellableWaitForMultipleObjects(
UINT64 Count,
VOID **ObjectArray,
_WAIT_TYPE WaitType,
PLARGE_INTEGER Timeout,
PKWAIT_BLOCK WaitBlockArray,
PIRP Irp){
LONGLONG QuadPart;
unsigned int v10;
volatile unsigned __int64 TickCountQuad;
unsigned int v12;
NTSTATUS result;
_BYTE *v14;
volatile unsigned __int64 v15;
unsigned int v16;
QuadPart = 0i64;
v10 = Count;
if( Timeout )
{
QuadPart = Timeout->QuadPart;
if( Timeout->QuadPart < 0 )
{
TickCountQuad = KUSER_SHARED_DATA.TickCountQuad;
KeQueryTimeIncrement((_BYTE *)Count);
QuadPart = TickCountQuad - Timeout->QuadPart / v12;
}
}
while( 1 )
{
result = v10 == 1 ? KeWaitForSingleObject((UINT64)*ObjectArray, 0, 0, 1, (INT64)Timeout) : KeWaitForMultipleObjects(
v10,
ObjectArray,
WaitType,
Executive,
0,
1u,
Timeout,
WaitBlockArray);
if( result != 257 )
break;
if( (*(_DWORD *)&KeGetCurrentThread()[1].gapD8[8] & 1) != 0 )
return -1073741749;
if( Irp && Irp->Cancel )
return -1073741536;
if( Timeout )
{
if( Timeout->QuadPart >= 0 )
{
if( *(__int64 *)&KUSER_SHARED_DATA.SystemTime.LowPart >= QuadPart )
return 258;
}
else
{
v15 = KUSER_SHARED_DATA.TickCountQuad;
if( (__int64)KUSER_SHARED_DATA.TickCountQuad >= QuadPart )
return 258;
KeQueryTimeIncrement(v14);
Timeout->QuadPart = -(__int64)((QuadPart - v15) * v16);
}
}
}
return result;
}Referenced by:
FsRtlCancellableWaitForSingleObject
FsRtlKernelFsControlFile
FsRtlQueryInformationFile
FsRtlQueryKernelEaFile
FsRtlSetKernelEaFile