解读 DelayExecution

来源：互联网发布：中国m1 m2历年数据编辑：程序博客网时间：2024/05/16 05:59

解读 DelayExecution

//----- (100E6897) --------------------------------------------------------
__int32 __stdcall Windows::Rtl::SystemImplementation::DelayExecution(Windows::Rtl::SystemImplementation *this, unsigned __int64 a2)
{

BUCL::CMultiplier<unsigned __int64,BUCL::Rtl::CCallDisposition>::Multiply(
    &v9,
    (int)&Interval,
    (unsigned int)this,
    a2,
    0x2710u,
    0);
v2 = v9;
if ( v9 < 0 )
    return v2;
if ( Interval.QuadPart > 0x7FFFFFFFFFFFFFFFui64 )
{
    v3 = 794;
    v4 = "Ticks <= (0x7fffffffffffffff)";
    v2 = -1073741675;
LABEL_6:
    v9 = v2;
    v7 = v3;
    v8 = v4;
    Interval.LowPart = (DWORD)"base\\wcp\\sil\\merged\\ntu\\ntsystem.cpp";
    Interval.HighPart = (LONG)"Windows::Rtl::SystemImplementation::DelayExecution";
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(
      (int *)&v9,
      (int)&Interval);
    return v2;
}
Interval.QuadPart = -Interval.QuadPart;
v2 = NtDelayExecution(0, &Interval);
if ( v2 < 0 )
{
    v3 = 797;
    v4 = "::NtDelayExecution(0, &Timeout)";
    goto LABEL_6;
}
return 0;
}

//----- (100E5138) --------------------------------------------------------
unsigned __int64 *__thiscall Windows::Rtl::SystemImplementation::CalculateExecutionDelay(void *ecx0)
{

v1 = (30 - (signed int)ecx0) / 0xAu;
if ( v1 >= 3 )
v1 = 2;
result = (&s_rgSharingViolationWaitMilliseconds)[v1];
v3 = dword_10045F04[2 * v1];
return result;
}
// 10045F00: using guessed type unsigned __int64 *s_rgSharingViolationWaitMilliseconds;
// 10045F04: using guessed type int dword_10045F04[];

0 0