ExGetHeapFromType

NTSTATUS __stdcall ExGetHeapFromType(INT64 a1, UINT64 a2, INT64 a3){
  __int64 *v3; 
  __int64 v4; 
  __int64 v5; 
  __int64 v6; 

  if( (_DWORD)a2 == 0x80000000 )
    LODWORD(a2) = KeGetCurrentPrcb()->ParentNode->Affinity.Reserved[0];
  v3 = &qword_140C57E00[1048 * ((unsigned int)a2 < dword_140C57DD0 ? a2 : 0)];
  if( (int)a1 < 0 )
  {
    if( (_DWORD)a3 )
      LODWORD(v5) = qword_140CDAE18;
    else
      return v3[3];
  }
  else if( (a1 & 0x21) == 33 )
  {
    v6 = *((_QWORD *)KeGetCurrentThread()->ApcState.Process->Session + 84);
    if( (_DWORD)a3 )
      return *(_QWORD *)(v6 + 14568);
    else
      return *(_QWORD *)(v6 + 14560);
  }
  else
  {
    if( (a1 & 1) != 0 )
      v4 = 2i64;
    else
      v4 = (a1 & 0x200) != 0;
    if( (_DWORD)a3 )
      return qword_140CDAE00[v4];
    else
      return v3[v4];
  }
  return v5;
}

Referenced by: