SmpKeyedStoreEntryGet

NTSTATUS __fastcall SmpKeyedStoreEntryGet(UINT64 BugCheckParameter2, INT64 *a2, INT64 er8_0, INT64 a4){
  int v4; 
  _ETHREAD *CurrentThread; 
  unsigned int SessionId; 
  __int64 v9; 
  INT64 v10; 
  int v11; 
  __int64 v12; 
  INT64 v13; 
  _ETHREAD *v15; 
  unsigned __int8 v16; 
  int v17; 
  bool v18; 
  __int64 v19; 
  _KLOCK_ENTRY *v20; 
  __int64 v21; 
  UINT64 v22; 
  unsigned int v23; 
  unsigned int v24; 
  __int64 v25; 
  __int64 v26; 
  __int64 v27; 
  VOID **v28; 
  int v29; 
  _QWORD *i; 
  char j; 
  unsigned __int64 v32; 
  unsigned int v33; 
  __int64 v34; 
  __int64 v35; 
  _QWORD *v36; 
  __int64 v37; 
  _PRIVILEGE_SET *v38; 
  char a3[12]; 
  __int64 v40; 
  INT64 v41; 
  INT64 v42; 
  __int64 v43; 
  int v44; 
  int v45; 

  v45 = a4;
  v44 = 0;
  v4 = er8_0;
  if( !(_DWORD)a4 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    if( (int)er8_0 > 0 )
      ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)BugCheckParameter2, 0i64);
    else
      ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)BugCheckParameter2, 0i64);
  }
  SessionId = -1;
  if( !v4 )
  {
    v9 = *(_QWORD *)(BugCheckParameter2 + 24);
    if( v9 && *(_QWORD *)(v9 + 8) == *a2 )
      goto LABEL_17;
    if( *a2 == *(_QWORD *)(BugCheckParameter2 + 32) )
    {
      LODWORD(v9) = 0;
      goto LABEL_17;
    }
  }
  v10 = *a2;
  v11 = *(_DWORD *)(BugCheckParameter2 + 12) >> 5;
  v12 = -1i64 << (*(_BYTE *)(BugCheckParameter2 + 12) & 0x1F);
  v13 = v12 & *a2;
  *(_QWORD *)&a3[4] = v13;
  if( !v11 )
    goto LABEL_15;
  v42 = v13;
  v9 = *(_QWORD *)(BugCheckParameter2 + 16)
     + 8i64
     * ((37
       * ((unsigned __int8)a3[10]
        + 37
        * ((unsigned __int8)a3[9]
         + 37
         * ((unsigned __int8)a3[8]
          + 37
          * ((unsigned __int8)a3[7]
           + 37 * ((unsigned __int8)a3[6] + 37 * ((unsigned __int8)a3[5] + 37 * ((unsigned __int8)v13 + 11623883)))))))
       + (unsigned __int8)a3[11]) & (unsigned int)(v11 - 1));
  while( 1 )
  {
    v9 = *(_QWORD *)v9;
    if( (v9 & 1) != 0 )
      break;
    if( v13 == (v12 & *(_QWORD *)(v9 + 8)) )
      goto LABEL_14;
  }
  v9 = 0i64;
LABEL_14:
  if( v9 )
  {
    if( v4 == 2 )
    {
      v29 = *(_DWORD *)(BugCheckParameter2 + 12) >> 5;
      *(_QWORD *)&a3[4] = *(_QWORD *)(v9 + 8) & (-1i64 << (*(_DWORD *)(BugCheckParameter2 + 12) & 0x1F));
      v43 = *(_QWORD *)&a3[4];
      for( i = (_QWORD *)(*(_QWORD *)(BugCheckParameter2 + 16)
                         + 8i64
                         * ((37
                           * ((unsigned __int8)a3[10]
                            + 37
                            * ((unsigned __int8)a3[9]
                             + 37
                             * ((unsigned __int8)a3[8]
                              + 37
                              * ((unsigned __int8)a3[7]
                               + 37
                               * ((unsigned __int8)a3[6]
                                + 37 * ((unsigned __int8)a3[5] + 37 * ((unsigned __int8)a3[4] + 11623883)))))))
                           + (unsigned __int8)a3[11]) & (unsigned int)(v29 - 1))); (*i & 1) == 0; i = (_QWORD *)*i )
      {
        if( *i == v9 )
        {
          *i = *(_QWORD *)v9;
          --*(_DWORD *)(BugCheckParameter2 + 8);
          *(_QWORD *)v9 |= 0x8000000000000002ui64;
          break;
        }
      }
      if( *(_QWORD *)(BugCheckParameter2 + 24) == v9 )
        *(_QWORD *)(BugCheckParameter2 + 24) = 0i64;
    }
    else
    {
      *(_QWORD *)(BugCheckParameter2 + 24) = v9;
    }
  }
  else
  {
LABEL_15:
    if( v4 != 1 )
    {
      *(_QWORD *)(BugCheckParameter2 + 32) = v10;
      LODWORD(v9) = 0;
      goto LABEL_17;
    }
    v22 = BugCheckParameter2 + 8;
    v44 = 1414032755;
    v23 = *(_DWORD *)(BugCheckParameter2 + 12);
    v9 = (__int64)(a2 - 1);
    v24 = 2 * (v23 >> 5);
    if( *(_DWORD *)(BugCheckParameter2 + 8) >= v24 )
    {
      v27 = v24;
      if( v24 < 4 )
        v27 = 4i64;
      v28 = SmAllocWrapper(8i64 * (unsigned int)v27, &v44);
      if( v28 )
      {
        if( (((_DWORD)v27 - 1) & (unsigned int)v27) != 0 )
        {
          for( j = -1; (_DWORD)v27; LODWORD(v27) = (unsigned int)v27 >> 1 )
            ++j;
          v27 = (unsigned int)(1 << j);
        }
        if( (unsigned int)v27 > 0x4000000 )
          v27 = 0x4000000i64;
        v32 = (unsigned int)v27;
        if( v28 > &v28[v27] )
          v32 = 0i64;
        if( v32 )
          memset64(v28, v22 | 1, v32);
        v33 = 0;
        v34 = -1i64 << (*(_BYTE *)(BugCheckParameter2 + 12) & 0x1F);
        if( (*(_DWORD *)(BugCheckParameter2 + 12) & 0xFFFFFFE0) != 0 )
        {
          do
          {
            v35 = *(_QWORD *)(v22 + 8);
            while( 1 )
            {
              v36 = *(_QWORD **)(v35 + 8i64 * v33);
              if( ((unsigned __int8)v36 & 1) != 0 )
                break;
              *(_QWORD *)(v35 + 8i64 * v33) = *v36;
              v40 = v34 & v36[1];
              v37 = (37
                   * (BYTE6(v40)
                    + 37
                    * (BYTE5(v40)
                     + 37
                     * (BYTE4(v40)
                      + 37
                      * (BYTE3(v40) + 37 * (BYTE2(v40) + 37 * (BYTE1(v40) + 37 * ((unsigned __int8)v40 + 11623883)))))))
                   + HIBYTE(v40)) & (unsigned int)(v27 - 1);
              *v36 = v28[v37];
              v28[v37] = v36;
            }
            v22 = BugCheckParameter2 + 8;
            ++v33;
          }
          while( v33 < *(_DWORD *)(BugCheckParameter2 + 12) >> 5 );
        }
        v38 = *(_PRIVILEGE_SET **)(v22 + 8);
        v23 = *(_DWORD *)(v22 + 4) & 0x1F | (32 * v27);
        *(_QWORD *)(v22 + 8) = v28;
        *(_DWORD *)(v22 + 4) = v23;
        if( v38 )
        {
          CmSiFreeMemory(v38);
          v23 = *(_DWORD *)(BugCheckParameter2 + 12);
        }
      }
      else
      {
        v23 = *(_DWORD *)(BugCheckParameter2 + 12);
        if( v23 < 0x20 )
        {
          LODWORD(v9) = 0;
          SessionId = -1;
          goto LABEL_17;
        }
      }
    }
    v41 = *a2 & (-1i64 << (v23 & 0x1F));
    v25 = *(_QWORD *)(v22 + 8);
    v26 = (37
         * (BYTE6(v41)
          + 37
          * (BYTE5(v41)
           + 37
           * (BYTE4(v41)
            + 37 * (BYTE3(v41) + 37 * (BYTE2(v41) + 37 * (BYTE1(v41) + 37 * ((unsigned __int8)v41 + 11623883)))))))
         + HIBYTE(v41)) & ((v23 >> 5) - 1);
    *(_QWORD *)v9 = *(_QWORD *)(v25 + 8 * v26);
    *(_QWORD *)(v25 + 8 * v26) = v9;
    ++*(_DWORD *)v22;
    SessionId = -1;
    if( *(_QWORD *)(BugCheckParameter2 + 32) == *a2 )
      *(_QWORD *)(BugCheckParameter2 + 32) = 0i64;
  }
LABEL_17:
  if( !v45 )
  {
    if( v4 > 0 )
    {
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((_EX_PUSH_LOCK *)BugCheckParameter2);
      *(_DWORD *)a3 = 0;
      v15 = (_ETHREAD *)KeGetCurrentThread();
      if( MiGetSystemRegionType(BugCheckParameter2) == 1 )
        SessionId = MmGetSessionIdEx(v15->Tcb.ApcState.Process);
      --v15->Tcb.SpecialApcDisable;
      v16 = ++v15->Tcb.AbAllocationRegionCount;
      v17 = ((char)v15->Tcb.AbEntrySummary | (char)v15->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
      while( 1 )
      {
        v18 = !_BitScanReverse((unsigned int *)&v19, v17);
        if( v18 )
          break;
        v20 = &v15->Tcb.LockEntries[v19];
        v17 &= ~(1 << v19);
        if( (v20->AcquiredByte & 1) != 0
          && (v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
          && (v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (BugCheckParameter2 & 0x7FFFFFFFFFFFFFFCi64)
          && v20->LockState.SessionId == SessionId )
        {
          v20->AcquiredByte &= ~1u;
          if( v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
          {
            if( v20 )
            {
              v20->CrossThreadReleasableAndBusyByte |= 2u;
              if( v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
                KiAbEntryRemoveFromTree(v20);
              *(_DWORD *)a3 = v20->BoostBitmap.AllFields & 0x1FFFF;
              v20->BoostBitmap.AllFields &= 0xFFFE0000;
              v20->ThreadLocalFlags &= ~1u;
              v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
              v21 = v20 - v15->Tcb.LockEntries;
              if( v16 == 1 )
                v15->Tcb.AbEntrySummary |= 1 << v21;
              else
                _InterlockedOr8((volatile signed __int8 *)&v15->Tcb.AbOrphanedEntrySummary, 1 << v21);
              goto LABEL_45;
            }
            break;
          }
        }
      }
      if( (*(&v15->Tcb.MiscFlags + 1) & 0x10000) == 0 )
        KeBugCheckEx(0x162u, v15, (PVOID)BugCheckParameter2, (PVOID)SessionId, 0i64);
LABEL_45:
      --v15->Tcb.AbAllocationRegionCount;
      KiAbThreadRemoveBoosts(&v15->Tcb, (VOID *)BugCheckParameter2, (UINT64 *)a3);
      v18 = v15->Tcb.SpecialApcDisable++ == -1;
      if( v18 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v15->Tcb.ApcState.ApcListHead[0].Flink != &v15->Tcb.152 )
        KiCheckForKernelApcDelivery();
    }
    else
    {
      if( _InterlockedCompareExchange64((volatile signed __int64 *)BugCheckParameter2, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((_EX_PUSH_LOCK *)BugCheckParameter2);
      KeAbPostRelease((VOID *)BugCheckParameter2);
    }
    KeLeaveCriticalRegion();
  }
  return v9;
}

Referenced by: