FlushLookUpTableBucket

UINT64 __stdcall FlushLookUpTableBucket(_TLG_AGGR_SESSION *AggregateSession, UINT64 BucketIndex){
  __int64 v2; 
  _ETHREAD *CurrentThread; 
  UINT64 v5; 
  unsigned __int8 v6; 
  __int64 v7; 
  unsigned int v8; 
  char v9; 
  __int64 v10; 
  NTSTATUS SessionId; 
  bool v12; 
  __int64 v13; 
  unsigned int v14; 
  unsigned int v15; 
  char v16; 
  _ETHREAD *v17; 
  unsigned __int8 v18; 
  int v19; 
  __int64 v20; 
  _KLOCK_ENTRY *v21; 
  int v22; 
  unsigned int v23; 
  __int64 v24; 
  __int64 AbOrphanedEntrySummary; 
  UINT64 v27; 
  int v28; 
  int v29; 
  UINT64 a3; 

  v2 = (unsigned int)BucketIndex;
  if( !*(_QWORD *)&AggregateSession[2 * (unsigned int)BucketIndex] )
    return 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = (UINT64)(AggregateSession + 68);
  LODWORD(a3) = 0;
  v6 = 0;
  --CurrentThread->Tcb.SpecialApcDisable;
  if( ++CurrentThread->Tcb.AbAllocationRegionCount != 1 )
    KeBugCheckEx(0x192u, CurrentThread, AggregateSession + 68, (PVOID)KeGetCurrentIrql(), 0i64);
  LOBYTE(v7) = CurrentThread->Tcb.AbEntrySummary;
  v8 = -1;
  v29 = 0;
  if( !(_BYTE)v7 )
  {
    if( !CurrentThread->Tcb.AbOrphanedEntrySummary )
    {
      v10 = 0i64;
      goto LABEL_41;
    }
    AbOrphanedEntrySummary = CurrentThread->Tcb.AbOrphanedEntrySummary;
    CurrentThread->Tcb.AbOrphanedEntrySummary = 0;
    LOBYTE(v7) = AbOrphanedEntrySummary | CurrentThread->Tcb.AbEntrySummary;
  }
  v9 = v7;
  _BitScanForward((unsigned int *)&v7, (unsigned __int8)v7);
  v29 = v7;
  CurrentThread->Tcb.AbEntrySummary = v9 & ~(1 << v7);
  v10 = (__int64)&CurrentThread->Tcb.LockEntries[v7];
  if( !v10 )
  {
LABEL_41:
    _interlockedbittestandset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 0x10u);
    goto LABEL_9;
  }
  if( v5 >= 0xFFFF800000000000ui64 && *((_BYTE *)&stru_140C4DB30 + ((v5 >> 39) & 0x1FF) + 6872) == 1 )
    SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
  else
    SessionId = -1;
  *(_DWORD *)(v10 + 40) = SessionId;
  *(_QWORD *)(v10 + 32) = v5 & 0x7FFFFFFFFFFFFFFCi64;
LABEL_9:
  --CurrentThread->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)v5, &a3);
  v12 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
  if( v12
    && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
  {
    KiCheckForKernelApcDelivery();
  }
  if( _interlockedbittestandset64((volatile signed __int32 *)v5, 0i64) )
    ExfAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v5, (VOID *)v10, (VOID *)v5);
  if( v10 )
    *(_BYTE *)(v10 + 26) |= 1u;
  if( !*((_BYTE *)AggregateSession + 373) )
    v6 = ExAcquireSpinLockExclusive((INT64 *)AggregateSession + 35);
  v13 = *(_QWORD *)&AggregateSession[2 * v2];
  *(_QWORD *)&AggregateSession[2 * v2] = 0i64;
  v14 = FlattenEventEntryTree(v13);
  AggregateSession[64] -= v14;
  v15 = v14;
  if( !*((_BYTE *)AggregateSession + 373) )
  {
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)AggregateSession + 35);
    __writecr8(v6);
  }
  v16 = _InterlockedExchangeAdd64((volatile signed __int64 *)v5, 0xFFFFFFFFFFFFFFFFui64);
  if( (v16 & 2) != 0 && (v16 & 4) == 0 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)v5);
  LODWORD(v27) = 0;
  v17 = (_ETHREAD *)KeGetCurrentThread();
  if( MiGetSystemRegionType(v5) == 1 )
    v8 = MmGetSessionIdEx(v17->Tcb.ApcState.Process);
  --v17->Tcb.SpecialApcDisable;
  v18 = ++v17->Tcb.AbAllocationRegionCount;
  v19 = ((char)v17->Tcb.AbEntrySummary | (char)v17->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
  while( 1 )
  {
    v12 = !_BitScanReverse((unsigned int *)&v20, v19);
    v28 = v20;
    if( v12 )
      break;
    v21 = &v17->Tcb.LockEntries[v20];
    v19 &= ~(1 << v20);
    if( (v21->AcquiredByte & 1) != 0
      && (v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
      && (v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v5 & 0x7FFFFFFFFFFFFFFCi64)
      && v21->LockState.SessionId == v8 )
    {
      v21->AcquiredByte &= ~1u;
      if( v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
      {
        if( v21 )
        {
          v21->CrossThreadReleasableAndBusyByte |= 2u;
          if( v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
            KiAbEntryRemoveFromTree(v21);
          v22 = v21->BoostBitmap.AllFields & 0x1FFFF;
          v23 = v21->BoostBitmap.AllFields & 0xFFFE0000;
          v21->ThreadLocalFlags &= ~1u;
          LODWORD(v27) = v22;
          v21->BoostBitmap.AllFields = v23;
          v21->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
          v24 = v21 - v17->Tcb.LockEntries;
          if( v18 == 1 )
            v17->Tcb.AbEntrySummary |= 1 << v24;
          else
            _InterlockedOr8((volatile signed __int8 *)&v17->Tcb.AbOrphanedEntrySummary, 1 << v24);
          goto LABEL_35;
        }
        break;
      }
    }
  }
  if( (*(&v17->Tcb.MiscFlags + 1) & 0x10000) == 0 )
    KeBugCheckEx(0x162u, v17, (PVOID)v5, (PVOID)v8, 0i64);
LABEL_35:
  --v17->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&v17->Tcb, (VOID *)v5, &v27);
  v12 = v17->Tcb.SpecialApcDisable++ == -1;
  if( v12 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v17->Tcb.ApcState.ApcListHead[0].Flink != &v17->Tcb.152 )
    KiCheckForKernelApcDelivery();
  FlushEventEntryList(*(_QWORD *)(*((_QWORD *)AggregateSession + 43) + 32i64), v13);
  return v15;
}

Referenced by: