NtReleaseKeyedEvent

NTSTATUS __stdcall NtReleaseKeyedEvent(
        VOID *KeyedEventHandle,
        VOID *KeyValue,
        UINT8 Alertable,
        _LARGE_INTEGER *Timeout){
  NTSTATUS v5; 
  char v6; 
  NTSTATUS result; 
  _ETHREAD *CurrentThread; 
  INT8 PreviousMode; 
  char *v10; 
  _EX_PUSH_LOCK *v11; 
  _EX_PUSH_LOCK *v12; 
  _BYTE *v13; 
  _BYTE *v14; 
  _EX_PUSH_LOCK *bf_0; 
  _EX_PUSH_LOCK *v16; 
  _QWORD *v17; 
  _QWORD *v18; 
  _EX_PUSH_LOCK *v19; 
  _EX_PUSH_LOCK **v20; 
  _BYTE *v21; 
  _BYTE *v22; 
  _QWORD *v23; 
  __int64 v24; 
  _QWORD *v25; 
  INT8 WaitMode; 
  LONGLONG QuadPart; 
  PVOID Object; 
  _TERMINATION_PORT *TerminationPort; 
  PADAPTER_OBJECT DmaAdapter; 
  _EPROCESS *Process; 
  _LARGE_INTEGER *Timeouta; 

  Timeouta = Timeout;
  v5 = 0;
  QuadPart = 0i64;
  TerminationPort = 0i64;
  v6 = 1;
  if( ((unsigned __int8)KeyValue & 1) != 0 )
    return -1073741585;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  WaitMode = PreviousMode;
  if( Timeout )
  {
    if( PreviousMode && ((unsigned __int64)&Timeout[1] > 0x7FFFFFFF0000i64 || &Timeout[1] < Timeout) )
      MEMORY[0x7FFFFFFF0000] = 0;
    QuadPart = Timeout->QuadPart;
    Timeouta = (_LARGE_INTEGER *)&QuadPart;
  }
  if( KeyedEventHandle )
  {
    Object = 0i64;
    result = ObReferenceObjectByHandle(KeyedEventHandle, 2ui64, ExpKeyedEventObjectType, PreviousMode, &Object, 0i64);
    v5 = result;
    v10 = (char *)Object;
    DmaAdapter = (PADAPTER_OBJECT)Object;
    if( result < 0 )
      return result;
  }
  else
  {
    v10 = (char *)*(&WheapDeferredInternalLogsEventLock + 72);
    DmaAdapter = (PADAPTER_OBJECT)*(&WheapDeferredInternalLogsEventLock + 72);
  }
  CurrentThread->SameThreadPassiveFlags |= 0x20u;
  Process = CurrentThread->Tcb.ApcState.Process;
  v11 = (_EX_PUSH_LOCK *)&v10[24 * (((unsigned __int64)KeyValue >> 5) & 0x3F)];
  v12 = v11 + 1;
  --CurrentThread->Tcb.KernelApcDisable;
  v13 = KeAbPreAcquire(v11, 0i64, 0i64);
  v14 = v13;
  if( _interlockedbittestandset64((volatile signed __int32 *)v11, 0i64) )
    ExfAcquirePushLockExclusiveEx(v11, v13, v11);
  if( v14 )
    v14[26] |= 1u;
  bf_0 = (_EX_PUSH_LOCK *)v12->_bf_0;
  if( (_EX_PUSH_LOCK *)v12->_bf_0 == v12 )
  {
LABEL_21:
    TerminationPort = CurrentThread->TerminationPort;
    CurrentThread->TerminationPort = (_TERMINATION_PORT *)((unsigned __int64)KeyValue | 1);
    v17 = CurrentThread->gap438;
    v18 = (_QWORD *)v12->_bf_0;
    if( *(_EX_PUSH_LOCK **)(v12->_bf_0 + 8) != v12 )
      goto LABEL_47;
    *v17 = v18;
    *(_QWORD *)&CurrentThread->gap438[8] = v12;
    v18[1] = v17;
    v12->_bf_0 = (__int64)v17;
    v16 = 0i64;
  }
  else
  {
    while( 1 )
    {
      v16 = bf_0 - 135;
      if( bf_0[4].Ptr == KeyValue && (_EPROCESS *)v16[68]._bf_0 == Process )
        break;
      bf_0 = (_EX_PUSH_LOCK *)bf_0->_bf_0;
      if( bf_0 == v12 )
        goto LABEL_21;
    }
    v19 = (_EX_PUSH_LOCK *)bf_0->_bf_0;
    v20 = (_EX_PUSH_LOCK **)bf_0[1]._bf_0;
    if( *(_EX_PUSH_LOCK **)(bf_0->_bf_0 + 8) != bf_0 || *v20 != bf_0 )
      goto LABEL_47;
    *v20 = v19;
    v19[1]._bf_0 = (__int64)v20;
    bf_0[1]._bf_0 = (__int64)bf_0;
    bf_0->_bf_0 = (__int64)bf_0;
  }
  if( (_InterlockedExchangeAdd64(&v11->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v11);
  KeAbPostRelease(v11);
  if( !v16 )
  {
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    v5 = KeWaitForSingleObject((UINT64)&CurrentThread->1160, 21, WaitMode, Alertable, (INT64)Timeouta);
    if( !v5 )
    {
LABEL_43:
      CurrentThread->TerminationPort = TerminationPort;
      goto LABEL_44;
    }
    --CurrentThread->Tcb.KernelApcDisable;
    v21 = KeAbPreAcquire(v11, 0i64, 0i64);
    v22 = v21;
    if( _interlockedbittestandset64((volatile signed __int32 *)v11, 0i64) )
      ExfAcquirePushLockExclusiveEx(v11, v21, v11);
    if( v22 )
      v22[26] |= 1u;
    v23 = CurrentThread->gap438;
    v24 = *(_QWORD *)CurrentThread->gap438;
    if( (_BYTE *)v24 == CurrentThread->gap438 )
    {
LABEL_39:
      if( (_InterlockedExchangeAdd64(&v11->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v11);
      KeAbPostRelease(v11);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
      if( v6 )
        v5 = KeWaitForSingleObject((UINT64)&CurrentThread->1160, 21, 0, 0, 0i64);
      goto LABEL_43;
    }
    v25 = *(_QWORD **)&CurrentThread->gap438[8];
    if( *(_QWORD **)(v24 + 8) == v23 && (_QWORD *)*v25 == v23 )
    {
      *v25 = v24;
      *(_QWORD *)(v24 + 8) = v25;
      *(_QWORD *)&CurrentThread->gap438[8] = CurrentThread->gap438;
      *v23 = v23;
      v6 = 0;
      goto LABEL_39;
    }
LABEL_47:
    __fastfail(3u);
  }
  KeReleaseSemaphore((_KSEMAPHORE *)&v16[145], 1i64, 1i64, 0);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
LABEL_44:
  CurrentThread->SameThreadPassiveFlags &= ~0x20u;
  if( KeyedEventHandle )
    HalPutDmaAdapter(DmaAdapter);
  return v5;
}

Referenced by: