RtlpHpHeapExtendContext
NTSTATUS __stdcall RtlpHpHeapExtendContext(UINT64 a1, INT64 a2){
UINT64 v2;
INT64 v3;
unsigned int v5;
signed __int64 v6;
UINT8 v8;
__int64 v9;
unsigned __int64 v10;
unsigned __int64 v11;
__int128 v12;
unsigned __int64 v13;
NTSTATUS v14;
bool v15;
int v16;
_ETHREAD *CurrentThread;
unsigned int v18;
unsigned __int8 v19;
int v20;
bool v21;
__int64 v22;
_KLOCK_ENTRY *v23;
int v24;
unsigned int v25;
__int64 v26;
unsigned int SessionId;
unsigned __int8 v28;
int v29;
__int64 v30;
_KLOCK_ENTRY *v31;
int v32;
unsigned int v33;
__int64 v34;
_ETHREAD *v35;
unsigned __int8 v36;
int v37;
__int64 v38;
_KLOCK_ENTRY *v39;
int v40;
unsigned int v41;
__int64 v42;
PVOID BugCheckParameter4;
UINT64 a3;
UINT64 v45;
unsigned __int64 v46;
__int64 v47[3];
__int128 v48;
__int128 v49[5];
UINT64 v51;
int v52;
v2 = a1 + 224;
v46 = 0i64;
v3 = a2;
v47[0] = 0i64;
RtlpHpAcquireReleaseLockExclusive(a1 + 224);
v5 = -1;
while( 1 )
{
while( 1 )
{
while( 1 )
{
v6 = *(_QWORD *)(a1 + 232);
if( (unsigned __int64)(v6 + v3) > *(_QWORD *)(a1 + 240) )
break;
if( v6 == _InterlockedCompareExchange64((volatile signed __int64 *)(a1 + 232), v6 + v3, v6) )
return v6;
}
v8 = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)v2, *(_DWORD *)a1 & 1);
v9 = *(_QWORD *)(a1 + 232);
v10 = *(_QWORD *)(a1 + 240);
v11 = v8;
if( v9 + v3 > v10 )
break;
if( (*(_DWORD *)a1 & 1) == 0 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v2);
LODWORD(v51) = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v2) == 1 )
SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
else
SessionId = -1;
--CurrentThread->Tcb.SpecialApcDisable;
v28 = ++CurrentThread->Tcb.AbAllocationRegionCount;
v29 = ((char)CurrentThread->Tcb.AbEntrySummary | (char)CurrentThread->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v21 = !_BitScanReverse((unsigned int *)&v30, v29);
if( v21 )
goto LABEL_54;
while( 1 )
{
v31 = &CurrentThread->Tcb.LockEntries[v30];
v29 &= ~(1 << v30);
if( (v31->AcquiredByte & 1) != 0
&& (v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v2 & 0x7FFFFFFFFFFFFFFCi64)
&& v31->LockState.SessionId == SessionId )
{
v31->AcquiredByte &= ~1u;
if( v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v21 = !_BitScanReverse((unsigned int *)&v30, v29);
if( v21 )
goto LABEL_54;
}
if( !v31 )
{
LABEL_54:
if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, CurrentThread, (PVOID)v2, (PVOID)SessionId, 0i64);
}
else
{
v31->CrossThreadReleasableAndBusyByte |= 2u;
if( v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v31);
v32 = v31->BoostBitmap.AllFields & 0x1FFFF;
v33 = v31->BoostBitmap.AllFields & 0xFFFE0000;
v31->ThreadLocalFlags &= ~1u;
LODWORD(v51) = v32;
v31->BoostBitmap.AllFields = v33;
v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v34 = v31 - CurrentThread->Tcb.LockEntries;
if( v28 == 1 )
CurrentThread->Tcb.AbEntrySummary |= 1 << v34;
else
_InterlockedOr8((volatile signed __int8 *)&CurrentThread->Tcb.AbOrphanedEntrySummary, 1 << v34);
}
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)v2, &v51);
v21 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( !v21 )
goto LABEL_28;
LABEL_26:
if( ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
KiCheckForKernelApcDelivery();
LABEL_28:
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
goto LABEL_29;
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v2);
__writecr8(v11);
}
v12 = *(_OWORD *)a1;
v47[0] = *(_QWORD *)(a1 + 240);
v13 = (v9 - v10 + 4095 + v3) & 0xFFFFFFFFFFFFF000ui64;
v46 = v13;
if( (*(_BYTE *)(a1 + 30) & 1) != 0 )
{
v48 = v12;
v14 = RtlpHpMetadataCommit(a1, v10, v13, &v48, 1);
}
else
{
LODWORD(BugCheckParameter4) = 4;
v49[0] = v12;
v14 = RtlpHpAllocVA(v47, (__int64 *)&v46, 0i64, 4096, (UINT64)BugCheckParameter4, (__int64)v49);
v13 = v46;
}
v15 = v14 < 0;
v16 = *(_DWORD *)a1;
if( v15 )
break;
*(_QWORD *)(a1 + 240) += v13;
if( (v16 & 1) == 0 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v2);
LODWORD(a3) = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v2) == 1 )
v18 = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
else
v18 = -1;
--CurrentThread->Tcb.SpecialApcDisable;
v19 = ++CurrentThread->Tcb.AbAllocationRegionCount;
v20 = ((char)CurrentThread->Tcb.AbEntrySummary | (char)CurrentThread->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v21 = !_BitScanReverse((unsigned int *)&v22, v20);
v52 = v22;
if( v21 )
goto LABEL_34;
while( 1 )
{
v23 = &CurrentThread->Tcb.LockEntries[v22];
v20 &= ~(1 << v22);
if( (v23->AcquiredByte & 1) != 0
&& (v23->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v23->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v2 & 0x7FFFFFFFFFFFFFFCi64)
&& v23->LockState.SessionId == v18 )
{
v23->AcquiredByte &= ~1u;
if( v23->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v21 = !_BitScanReverse((unsigned int *)&v22, v20);
v52 = v22;
if( v21 )
goto LABEL_34;
}
if( !v23 )
{
LABEL_34:
if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, CurrentThread, (PVOID)v2, (PVOID)v18, 0i64);
}
else
{
v23->CrossThreadReleasableAndBusyByte |= 2u;
if( v23->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v23);
v24 = v23->BoostBitmap.AllFields & 0x1FFFF;
v25 = v23->BoostBitmap.AllFields & 0xFFFE0000;
v23->ThreadLocalFlags &= ~1u;
LODWORD(a3) = v24;
v23->BoostBitmap.AllFields = v25;
v23->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v26 = v23 - CurrentThread->Tcb.LockEntries;
if( v19 == 1 )
CurrentThread->Tcb.AbEntrySummary |= 1 << v26;
else
_InterlockedOr8((volatile signed __int8 *)&CurrentThread->Tcb.AbOrphanedEntrySummary, 1 << v26);
}
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)v2, &a3);
v21 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( !v21 )
goto LABEL_28;
goto LABEL_26;
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v2);
__writecr8(v11);
LABEL_29:
v3 = a2;
}
LODWORD(v6) = 0;
if( (v16 & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v2);
__writecr8(v11);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v2);
LODWORD(v45) = 0;
v35 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v2) == 1 )
v5 = MmGetSessionIdEx(v35->Tcb.ApcState.Process);
--v35->Tcb.SpecialApcDisable;
v36 = ++v35->Tcb.AbAllocationRegionCount;
v37 = ((char)v35->Tcb.AbEntrySummary | (char)v35->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v21 = !_BitScanReverse((unsigned int *)&v38, v37);
HIDWORD(a3) = v38;
if( v21 )
break;
v39 = &v35->Tcb.LockEntries[v38];
v37 &= ~(1 << v38);
if( (v39->AcquiredByte & 1) != 0
&& (v39->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v39->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v2 & 0x7FFFFFFFFFFFFFFCi64)
&& v39->LockState.SessionId == v5 )
{
v39->AcquiredByte &= ~1u;
if( v39->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v39 )
{
v39->CrossThreadReleasableAndBusyByte |= 2u;
if( v39->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v39);
v40 = v39->BoostBitmap.AllFields & 0x1FFFF;
v41 = v39->BoostBitmap.AllFields & 0xFFFE0000;
v39->ThreadLocalFlags &= ~1u;
LODWORD(v45) = v40;
v39->BoostBitmap.AllFields = v41;
v39->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v42 = v39 - v35->Tcb.LockEntries;
if( v36 == 1 )
v35->Tcb.AbEntrySummary |= 1 << v42;
else
_InterlockedOr8((volatile signed __int8 *)&v35->Tcb.AbOrphanedEntrySummary, 1 << v42);
goto LABEL_79;
}
break;
}
}
}
if( (*(&v35->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v35, (PVOID)v2, (PVOID)v5, 0i64);
LABEL_79:
--v35->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v35->Tcb, (VOID *)v2, &v45);
v21 = v35->Tcb.SpecialApcDisable++ == -1;
if( v21 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v35->Tcb.ApcState.ApcListHead[0].Flink != &v35->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
return v6;
}Referenced by:
RtlpHpSegLfhExtendContext