RtlpHpSegPageRangeCoalesce

NTSTATUS __stdcall RtlpHpSegPageRangeCoalesce(INT64 a1, INT64 a2, CHAR r8_0, INT64 a4, CHAR *a5){
  int v5; 
  UINT64 v9; 
  INT64 v10; 
  unsigned int v11; 
  INT64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  __int64 v17; 
  unsigned __int64 v19; 
  CHAR v20; 
  char v21; 
  char v22; 
  __int64 v23; 
  _ETHREAD *CurrentThread; 
  __int64 SessionId; 
  unsigned __int8 v26; 
  int v27; 
  bool v28; 
  __int64 v29; 
  _KLOCK_ENTRY *v30; 
  __int64 v31; 
  __int64 v32[9]; 
  UINT64 a3; 
  int v34; 

  v5 = a4;
  LODWORD(v32[0]) = 0;
  while( 1 )
  {
    v9 = 0i64;
    v10 = (a2 - (a2 & *(_QWORD *)a1)) >> 5;
    v11 = (unsigned __int16)~*(_WORD *)(a2 + 28);
    if( (unsigned int)v10 + (unsigned __int8)HIBYTE(*(_DWORD *)(a2 + 28)) < 0x100 )
    {
      v9 = a2 + 32i64 * (unsigned __int8)HIBYTE(*(_DWORD *)(a2 + 28));
      if( (*(_BYTE *)(v9 + 24) & 1) != 0 )
        v9 = 0i64;
    }
    if( (unsigned int)v10 > *(unsigned __int8 *)(a1 + 10) )
    {
      v12 = a2 - 32;
      if( (*(_BYTE *)(a2 - 8) & 2) == 0 )
        v12 += -32i64 * *(unsigned __int8 *)(v12 + 31);
      if( (*(_BYTE *)(v12 + 24) & 1) == 0 )
      {
        RtlpHpSegFreeRangeRemove(a1, v12);
        *(_BYTE *)(v12 + 31) += *(_BYTE *)(a2 + 31);
        v11 += (unsigned __int16)~*(_WORD *)(v12 + 28);
        *(_WORD *)(v12 + 28) = ~(_WORD)v11;
        *(_BYTE *)(a2 + 24) &= (*(_BYTE *)(a2 + 31) <= 1u) - 4;
        a2 = v12;
        *(_BYTE *)(32i64 * ((unsigned int)*(unsigned __int8 *)(v12 + 31) - 1) + v12 + 31) = *(_BYTE *)(v12 + 31) - 1;
      }
    }
    *(_BYTE *)(a2 + 24) |= 0x11u;
    if( v9 )
    {
      RtlpHpSegFreeRangeRemove(a1, v9);
      v21 = *(_BYTE *)(a2 + 31);
      if( v21 != 1 )
      {
        *(_BYTE *)(32i64 * ((unsigned int)*(unsigned __int8 *)(a2 + 31) - 1) + a2 + 24) &= ~1u;
        v21 = *(_BYTE *)(a2 + 31);
      }
      *(_BYTE *)(a2 + 31) = v21 + *(_BYTE *)(v9 + 31);
      v11 += (unsigned __int16)~*(_WORD *)(v9 + 28);
      *(_WORD *)(a2 + 28) = ~(_WORD)v11;
      *(_BYTE *)(v9 + 24) &= ~2u;
      v22 = *(_BYTE *)(a2 + 31) - 1;
      v23 = 32i64 * ((unsigned int)*(unsigned __int8 *)(a2 + 31) - 1);
      *(_BYTE *)(v23 + a2 + 24) |= 1u;
      *(_BYTE *)(v23 + a2 + 31) = v22;
    }
    if( !v11 )
      break;
    if( !v5 && (*(_BYTE *)(a1 + 13) & 8) == 0 )
    {
      v13 = *(__int16 *)(a1 + 22);
      v14 = *(_QWORD *)(v13 + a1 + 8) >> *(_BYTE *)(a1 + 11);
      if( v14 <= 8 )
        v14 = 8i64;
      v15 = *(_QWORD *)(v13 + a1 + 8) >> *(_BYTE *)(a1 + 12);
      if( v15 <= 8 )
        v15 = 8i64;
      v16 = v11 + *(_QWORD *)(v13 + a1 + 16) + *(_QWORD *)(v13 + a1 + 24);
      if( (v16 <= v14 || (int)RtlpHpScheduleCompaction(*(_QWORD **)(a1 + 56)) >= 0) && v16 <= v15 )
        break;
    }
    v19 = (unsigned __int8)*a5;
    if( (r8_0 & 1) == 0 )
    {
      if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
      {
        ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a1 + 64));
        __writecr8(v19);
      }
      else
      {
        if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 64), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((_EX_PUSH_LOCK *)(a1 + 64));
        LODWORD(a3) = 0;
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        if( MiGetSystemRegionType(a1 + 64) == 1 )
          SessionId = (unsigned int)MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
        else
          SessionId = 0xFFFFFFFFi64;
        --CurrentThread->Tcb.SpecialApcDisable;
        v26 = ++CurrentThread->Tcb.AbAllocationRegionCount;
        v27 = ((char)CurrentThread->Tcb.AbEntrySummary | (char)CurrentThread->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
        v28 = !_BitScanReverse((unsigned int *)&v29, v27);
        v34 = v29;
        if( v28 )
          goto LABEL_50;
        while( 1 )
        {
          v30 = &CurrentThread->Tcb.LockEntries[v29];
          v27 &= ~(1 << v29);
          if( (v30->AcquiredByte & 1) != 0
            && (v30->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
            && (v30->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((a1 + 64) & 0x7FFFFFFFFFFFFFFCi64)
            && v30->LockState.SessionId == (_DWORD)SessionId )
          {
            v30->AcquiredByte &= ~1u;
            if( v30->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
              break;
          }
          v28 = !_BitScanReverse((unsigned int *)&v29, v27);
          v34 = v29;
          if( v28 )
            goto LABEL_50;
        }
        if( !v30 )
        {
LABEL_50:
          if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x10000) == 0 )
            KeBugCheckEx(0x162u, CurrentThread, (PVOID)(a1 + 64), (PVOID)SessionId, 0i64);
        }
        else
        {
          v30->CrossThreadReleasableAndBusyByte |= 2u;
          if( v30->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
            KiAbEntryRemoveFromTree(v30);
          LODWORD(a3) = 0;
          LODWORD(a3) = v30->BoostBitmap.AllFields & 0x1FFFF;
          v30->BoostBitmap.AllFields &= 0xFFFE0000;
          v30->ThreadLocalFlags &= ~1u;
          v30->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
          v31 = v30 - CurrentThread->Tcb.LockEntries;
          if( v26 == 1 )
            CurrentThread->Tcb.AbEntrySummary |= 1 << v31;
          else
            _InterlockedOr8((volatile signed __int8 *)&CurrentThread->Tcb.AbOrphanedEntrySummary, 1 << v31);
        }
        --CurrentThread->Tcb.AbAllocationRegionCount;
        KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)(a1 + 64), &a3);
        v28 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
        if( v28
          && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
        {
          KiCheckForKernelApcDelivery();
        }
        KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
      }
    }
    RtlpHpSegPageRangeCommit(
      (UINT16 *)a1,
      a2,
      0,
      -(*(unsigned __int8 *)(a2 + 31) << *(_BYTE *)(a1 + 9)),
      0,
      (__int64)v32);
    v20 = RtlpHpSegLockAcquire(a1, r8_0);
    *a5 = v20;
    *(_BYTE *)(a2 + 24) &= ~0x10u;
  }
  v17 = 32i64 * ((unsigned int)*(unsigned __int8 *)(a2 + 31) - 1);
  *(_BYTE *)(v17 + a2 + 24) &= ~1u;
  *(_BYTE *)(a2 + 24) &= 0xEEu;
  return a2;
}

Referenced by: