ExGetBigPoolInfo

NTSTATUS __stdcall ExGetBigPoolInfo(
        PVOID SystemInformation,
        UINT64 SystemInformationLength,
        UINT64 SystemPool,
        UINT64 *ReturnLength){
  unsigned int v4; 
  void *HeapPages; 
  unsigned __int64 v6; 
  int v7; 
  __int64 v8; 
  _DWORD *v9; 
  unsigned __int8 v10; 
  const VOID *v11; 
  unsigned int v12; 
  __int64 v13; 
  VOID *v14; 
  VOID *v16; 
  VOID *v17; 
  unsigned int v18; 
  NTSTATUS v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  char *v22; 
  char *v23; 
  int v24; 

  v24 = SystemPool;
  v4 = SystemInformationLength;
  HeapPages = 0i64;
  v19 = 0;
  v6 = 0i64;
  v7 = 16;
  v8 = 8i64;
  if( (_DWORD)SystemPool == 1 )
    v7 = 8;
  v18 = v7;
  v9 = SystemInformation;
  if( (_DWORD)SystemPool != 1 )
  {
    v9 = (char *)SystemInformation + 12;
    v8 = 16i64;
  }
  v23 = (char *)SystemInformation + v8;
  if( v4 )
    *v9 = 0;
  while( 1 )
  {
    v10 = ExAcquireSpinLockExclusive(&ExpLargePoolTableLock);
    if( v24 == 1 )
    {
      v11 = (const VOID *)PoolBigPageTable;
      v21 = PoolBigPageTableSize;
    }
    else
    {
      v11 = *(const VOID **)(qword_140C4DB20 + 992);
      v21 = *(_QWORD *)(qword_140C4DB20 + 1000);
    }
    if( !v11 )
    {
      ExReleaseSpinLockExclusiveFromDpcLevel(&ExpLargePoolTableLock);
      __writecr8(v10);
      if( HeapPages )
      {
        LODWORD(v17) = ExGetHeapFromVA(HeapPages);
        RtlpHpFreeHeap(v17, HeapPages, 0i64);
      }
      *(_DWORD *)ReturnLength = 0;
      return 0;
    }
    if( HeapPages && v6 >= v21 )
      break;
    v6 = v21;
    ExReleaseSpinLockExclusiveFromDpcLevel(&ExpLargePoolTableLock);
    __writecr8(v10);
    if( HeapPages )
    {
      LODWORD(v16) = ExGetHeapFromVA(HeapPages);
      RtlpHpFreeHeap(v16, HeapPages, 0i64);
    }
    HeapPages = ExAllocateHeapPages();
    if( !HeapPages )
      return -1073741670;
  }
  memmove(HeapPages, v11, 24 * v21);
  ExReleaseSpinLockExclusiveFromDpcLevel(&ExpLargePoolTableLock);
  __writecr8(v10);
  v20 = (unsigned __int64)HeapPages;
  v22 = v23;
  while( 1 )
  {
    v12 = v18;
    if( v20 >= (unsigned __int64)HeapPages + 24 * v21 )
      break;
    v13 = *(_QWORD *)v20;
    if( (*(_QWORD *)v20 & 1) == 0 )
    {
      if( v4 )
        ++*v9;
      v18 += 24;
      if( v12 >= 0xFFFFFFE8 )
      {
        v19 = -1073741675;
        break;
      }
      if( v18 <= v4 )
      {
        if( v4 )
        {
          *(_QWORD *)v22 = v13;
          if( v24 == 1 && (*(_DWORD *)(v20 + 12) & 0x100) == 0 )
            *(_QWORD *)v22 = v13 | 1;
          *((_DWORD *)v22 + 4) = *(_DWORD *)(v20 + 8);
          *((_QWORD *)v22 + 1) = *(_QWORD *)(v20 + 16);
          v22 += 24;
        }
      }
      else
      {
        v19 = -1073741820;
      }
    }
    v20 += 24i64;
  }
  LODWORD(v14) = ExGetHeapFromVA(HeapPages);
  RtlpHpFreeHeap(v14, HeapPages, 0i64);
  *(_DWORD *)ReturnLength = v18;
  return v19;
}

Referenced by: