RtlpHpVsContextFree
VOID __stdcall RtlpHpVsContextFree(INT64 *SpinLock, VOID *Address, VOID *a3, UINT64 a4, INT64 a5){
char v6;
int v9;
unsigned __int64 v10;
unsigned int v11;
_SLIST_ENTRY *v12;
_SLIST_ENTRY *v13;
int v14;
_SLIST_ENTRY *Next;
UINT64 v16;
_SLIST_ENTRY *v17;
UINT64 v18;
unsigned __int64 v19;
int v20;
int v21;
unsigned __int64 v22;
unsigned int i;
INT64 v24;
unsigned __int64 v25;
__int64 v26;
__int64 v27;
unsigned int v28;
UINT64 v29;
UINT64 v30;
unsigned __int64 v31;
_WORD *v32;
__int16 v33;
UINT64 v34;
UINT64 v35;
BOOL v36;
UINT64 v37;
int v38;
int v39;
unsigned __int64 v40;
int v41;
unsigned __int64 v42;
INT64 v43;
UINT64 v44;
INT64 v45[2];
__int64 v46;
int v47;
UINT64 v48;
UINT64 v49;
UINT64 v50;
LODWORD(v50) = a4;
v6 = a4;
v9 = *((_DWORD *)SpinLock + 44);
v10 = (unsigned __int64)a3 - 16;
if( (v9 & 1) != 0 && ((unsigned __int16)a3 & 0xFFF) == 0 )
v10 = (unsigned __int64)a3 - 32;
if( !Address )
{
v38 = DWORD1(RtlpHpHeapGlobals) ^ HIDWORD(v10) ^ HIDWORD(*(_QWORD *)v10);
if( (v38 & 0xFF0000) != 0 )
{
v39 = (unsigned __int8)(RtlpHpHeapGlobals ^ v10 ^ *(_BYTE *)(v10 + 8));
}
else
{
if( (_WORD)v38 )
{
v40 = v10 - 16i64 * (unsigned __int16)((v10 ^ (unsigned __int64)RtlpHpHeapGlobals ^ *(_QWORD *)v10) >> 32);
v41 = DWORD1(RtlpHpHeapGlobals) ^ HIDWORD(v40) ^ HIDWORD(*(_QWORD *)v40);
if( (v41 & 0xFF0000) != 0 )
{
v39 = (unsigned __int8)(RtlpHpHeapGlobals ^ v40 ^ *(_BYTE *)(v40 + 8));
}
else if( (_WORD)v41 )
{
v40 -= 16i64 * (unsigned __int16)(((unsigned __int64)RtlpHpHeapGlobals ^ v40 ^ *(_QWORD *)v40) >> 32);
v39 = (unsigned __int8)(RtlpHpHeapGlobals ^ v40 ^ *(_BYTE *)(v40 + 8));
}
else
{
v39 = 0;
}
v6 = v50;
goto LABEL_64;
}
v39 = 0;
}
v40 = v10;
LABEL_64:
Address = (VOID *)((v40 - (unsigned int)(v39 << 12)) & 0xFFFFFFFFFFFFF000ui64);
}
if( (((unsigned __int16)(*((_WORD *)Address + 16) ^ *((_WORD *)Address + 17)) ^ 0x2BED) & 0x7FFF) != 0 )
{
RtlpLogHeapFailure(
heap_failure_vs_subsegment_corruption,
(VOID *)((unsigned __int64)SpinLock ^ SpinLock[16]),
Address,
0i64,
0i64);
}
else if( ((v10 ^ (unsigned __int64)RtlpHpHeapGlobals ^ *(_QWORD *)v10) & 0xFF000000000000i64) != 0 )
{
v11 = 16 * (WORD1(RtlpHpHeapGlobals) ^ WORD1(v10) ^ *(unsigned __int16 *)(v10 + 2)) - 16;
*(_DWORD *)a5 = v11;
v12 = 0i64;
if( (v9 & 4) != 0 && v11 < 0x1000 )
{
if( *((_WORD *)SpinLock + 32) < 0x20u )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)SpinLock + 4, (PSLIST_ENTRY)(v10 + 16));
return;
}
RtlpInterlockedFlushSList();
}
v13 = (_SLIST_ENTRY *)(v10 + 16);
*(_QWORD *)(v10 + 16) = v12;
v14 = v6 & 1;
v46 = 0i64;
v47 = v14;
*(_OWORD *)v45 = 0i64;
if( (v6 & 1) == 0 )
RtlpHpAcquireQueuedLockExclusive((INT8)SpinLock, (UINT64 *)*((unsigned int *)SpinLock + 2));
if( v10 != -16i64 )
{
do
{
Next = v13[-1].Next;
v16 = (UINT64)&v13[-1];
v17 = v13;
v13 = v13->Next;
v18 = v16;
v19 = ((unsigned __int64)RtlpHpHeapGlobals ^ v16 ^ (unsigned __int64)Next) >> 32;
v20 = v19 & 0xFF0000;
if( (v19 & 0xFF0000) != 0 )
{
v21 = (unsigned __int8)(RtlpHpHeapGlobals ^ v16 ^ *((_BYTE *)&v17[-1].Next + 8));
}
else
{
if( !(_WORD)v19 )
goto LABEL_84;
v18 = v16 - 16i64 * (unsigned __int16)v19;
v42 = ((unsigned __int64)RtlpHpHeapGlobals ^ v18 ^ *(_QWORD *)v18) >> 32;
if( (v42 & 0xFF0000) != 0 )
{
v21 = (unsigned __int8)(RtlpHpHeapGlobals ^ v18 ^ *(_BYTE *)(v18 + 8));
}
else
{
if( !(_WORD)v42 )
{
LABEL_84:
v21 = 0;
goto LABEL_14;
}
v18 -= 16i64 * (unsigned __int16)v42;
v21 = (unsigned __int8)(RtlpHpHeapGlobals ^ v18 ^ *(_BYTE *)(v18 + 8));
}
}
LABEL_14:
v22 = (v18 - (unsigned int)(v21 << 12)) & 0xFFFFFFFFFFFFF000ui64;
if( (((unsigned __int16)(*(_WORD *)(v22 + 32) ^ *(_WORD *)(v22 + 34)) ^ 0x2BED) & 0x7FFF) != 0 )
{
RtlpLogHeapFailure(
heap_failure_vs_subsegment_corruption,
(VOID *)((unsigned __int64)SpinLock ^ SpinLock[16]),
(VOID *)v22,
0i64,
0i64);
}
else if( v20 )
{
LODWORD(v48) = 0;
for( i = 0; ; i = v28 )
{
v24 = RtlpHpVsChunkCoalesce((INT64)SpinLock, v22, v16, &v48);
v28 = v48;
v16 = v24;
if( (_DWORD)v48 == *(unsigned __int16 *)(v22 + 32) )
{
RtlpHpVsSubsegmentCleanup(SpinLock, v22, v26, v27);
if( !v14 )
RtlpHpReleaseQueuedLockExclusive(*((unsigned int *)SpinLock + 2), (INT64)v45);
RtlpHpVsSubsegmentFree((INT64)SpinLock, v22, (unsigned int)v50);
if( !v14 )
RtlpHpAcquireQueuedLockExclusive((INT8)SpinLock, (UINT64 *)*((unsigned int *)SpinLock + 2));
goto LABEL_46;
}
if( (unsigned int)v48 <= i )
break;
LODWORD(v49) = 0;
v44 = 0i64;
RtlpHpVsChunkComputeCost(v24, v22, &v49, &v44);
if( !(_DWORD)v49 )
break;
v29 = v44;
if( !v44 )
goto LABEL_26;
v30 = v44 - ((v44 >> 1) & 0x5555555555555555i64);
v25 = v30 & 0x3333333333333333i64;
v31 = (0x101010101010101i64
* (((v30 & 0x3333333333333333i64)
+ ((v30 >> 2) & 0x3333333333333333i64)
+ (((v30 & 0x3333333333333333i64) + ((v30 >> 2) & 0x3333333333333333i64)) >> 4)) & 0xF0F0F0F0F0F0F0Fi64)) >> 56;
if( *(__int16 *)(v22 + 34) < 0 )
goto LABEL_26;
if( (SpinLock[22] & 2) == 0 )
{
v25 = (unsigned __int64)SpinLock[6] >> 7;
if( v25 <= 8 )
v25 = 8i64;
if( SpinLock[7] + (unsigned __int64)(unsigned int)v31 <= v25 )
{
LABEL_26:
v14 = v47;
break;
}
}
v49 = 0x1000000000000i64;
*(_BYTE *)(v16 + 6) = BYTE6(RtlpHpHeapGlobals) ^ BYTE6(v16) ^ 1;
*(_DWORD *)(v16 + 8) = (unsigned __int8)(RtlpHpHeapGlobals ^ v16 ^ ((unsigned int)(v16 - v22) >> 12)) | 0x200;
if( !v47 )
RtlpHpReleaseQueuedLockExclusive(*((unsigned int *)SpinLock + 2), (INT64)v45);
LODWORD(v43) = 0;
RtlpHpVsSubsegmentCommitPages((INT64)SpinLock, v22, v29, (unsigned int)v31, v43);
v14 = v47;
if( !v47 )
RtlpHpAcquireQueuedLockExclusive((INT8)SpinLock, (UINT64 *)*((unsigned int *)SpinLock + 2));
*(_DWORD *)(v16 + 8) &= ~0x200u;
}
if( (SpinLock[22] & 1) != 0 && ((v16 + 32) & 0xFFF) != 0 )
{
v32 = (_WORD *)RtlpHpVsChunkAlignSplit(v25, v22, v16);
if( v32 )
RtlpHpVsFreeChunkInsert((UINT64 *)SpinLock, v22, v32);
}
LODWORD(v48) = 0;
v49 = 0i64;
v33 = RtlpHpVsChunkComputeCost(v16, v22, &v48, &v49);
v34 = ((v49 - ((v49 >> 1) & 0x5555555555555555i64)) & 0x3333333333333333i64)
+ (((v49 - ((v49 >> 1) & 0x5555555555555555i64)) >> 2) & 0x3333333333333333i64);
SpinLock[7] += (unsigned int)((0x101010101010101i64 * ((v34 + (v34 >> 4)) & 0xF0F0F0F0F0F0F0Fi64)) >> 32) >> 24;
*(_WORD *)v16 = RtlpHpHeapGlobals ^ v16 ^ (v48
+ v33
- ((0x101010101010101i64 * ((v34 + (v34 >> 4)) & 0xF0F0F0F0F0F0F0Fi64)) >> 56));
v35 = SpinLock[2];
if( (SpinLock[3] & 1) != 0 && v35 )
v35 ^= (unsigned __int64)(SpinLock + 2);
v36 = 0;
if( v35 )
{
while( 1 )
{
if( ((unsigned int)RtlpHpHeapGlobals ^ (unsigned int)v16 ^ *(_DWORD *)v16) < ((unsigned int)RtlpHpHeapGlobals ^ ((_DWORD)v35 - 8) ^ *(_DWORD *)(v35 - 8)) )
{
v37 = *(_QWORD *)v35;
if( (SpinLock[3] & 1) != 0 )
{
if( !v37 )
goto LABEL_43;
v37 ^= v35;
}
if( !v37 )
{
LABEL_43:
v36 = 0;
break;
}
}
else
{
v37 = *(_QWORD *)(v35 + 8);
if( (SpinLock[3] & 1) != 0 )
{
if( !v37 )
goto LABEL_44;
v37 ^= v35;
}
if( !v37 )
{
LABEL_44:
v36 = 1;
break;
}
}
v35 = v37;
}
}
RtlRbInsertNodeEx((UINT64 *)SpinLock + 2, v35, v36, v16 + 8);
}
else
{
RtlpLogHeapFailure(
heap_failure_block_not_busy,
(VOID *)((unsigned __int64)SpinLock ^ SpinLock[16]),
(VOID *)v16,
0i64,
0i64);
}
LABEL_46:
;
}
while( v13 );
}
if( !v14 )
RtlpHpReleaseQueuedLockExclusive(*((unsigned int *)SpinLock + 2), (INT64)v45);
}
else
{
RtlpLogHeapFailure(
heap_failure_block_not_busy,
(VOID *)((unsigned __int64)SpinLock ^ SpinLock[16]),
a3,
(VOID *)v10,
0i64);
}
}Referenced by:
ExFreeHeapPool
RtlpFreeHeapInternal
RtlpHpSegFree