RtlpHpVaMgrAlloc
NTSTATUS __stdcall RtlpHpVaMgrAlloc(PVOID BugCheckParameter2){
unsigned __int64 *v1;
unsigned __int64 v2;
UINT64 v3;
unsigned __int64 v4;
INT64 *v5;
INT64 v7;
char v8;
unsigned __int64 v9;
unsigned __int64 v10;
unsigned __int64 v11;
unsigned int v12;
UINT8 *v13;
UINT8 *v14;
UINT64 v15;
INT64 v16;
_ETHREAD *v17;
char v18;
int v19;
bool v20;
__int64 v21;
unsigned __int64 v22;
__int64 v23;
_ETHREAD *CurrentThread;
unsigned int SessionId;
char v26;
int v27;
__int64 v28;
unsigned __int64 v29;
unsigned __int8 v30;
UINT64 v32;
int v33;
unsigned int v34[2];
int v35;
INT64 v36;
UINT8 *a4;
INT64 v38[2];
__int64 v39;
unsigned __int64 v40;
UINT64 v41;
int v42;
int v43;
a4 = 0i64;
v32 = 0i64;
v3 = v2;
v4 = *v1;
v5 = (INT64 *)v1;
v41 = 0x10000000100000i64;
v42 = 0x200000;
v43 = 0x40000000;
if( !v4 )
__int2c();
if( v4 <= (unsigned __int64)(*((unsigned __int16 *)BugCheckParameter2 + 20) << 20) >> 1 )
{
v9 = v4 >> 20;
v10 = RtlpHpAcquireLockExclusive((INT64 *)BugCheckParameter2, *((_BYTE *)BugCheckParameter2 + 46) & 1);
RtlpHpVaMgrRangeFind((INT64)BugCheckParameter2, v9, v3 >> 20, &a4);
v12 = -1;
v13 = (UINT8 *)v11;
if( v11 )
{
RtlRbRemoveNode((unsigned __int64 *)BugCheckParameter2 + 1, v11);
v14 = a4;
if( a4 != v13 )
{
*(_OWORD *)v13 = 0i64;
*((_QWORD *)v13 + 2) = 0i64;
*v13 = 1;
v13[1] = *((_BYTE *)BugCheckParameter2 + 44);
RtlpHpVaMgrRangeSplit((INT64)BugCheckParameter2, (INT64)v13, (v14 - v13) >> 5);
RtlpHpVaMgrFree((INT64)BugCheckParameter2, (UINT64)v13);
v13 = v14;
}
}
else
{
if( (*((_BYTE *)BugCheckParameter2 + 46) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)BugCheckParameter2);
__writecr8(v10);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
v34[0] = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)BugCheckParameter2) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
else
SessionId = -1;
--*((_WORD *)CurrentThread + 243);
v26 = ++*((_BYTE *)CurrentThread + 794);
v27 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
v20 = !_BitScanReverse((unsigned int *)&v28, v27);
v33 = v28;
if( v20 )
goto LABEL_52;
while( 1 )
{
v29 = *((_QWORD *)CurrentThread + 100) + 96 * v28;
v27 &= ~(1 << v28);
if( (*(_BYTE *)(v29 + 26) & 1) != 0
&& (*(_DWORD *)(v29 + 32) & 1) == 0
&& (*(_QWORD *)(v29 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)BugCheckParameter2 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v29 + 40) == SessionId )
{
*(_BYTE *)(v29 + 26) &= ~1u;
if( *(_QWORD *)(v29 + 32) )
break;
}
v20 = !_BitScanReverse((unsigned int *)&v28, v27);
v33 = v28;
if( v20 )
goto LABEL_52;
}
if( !v29 )
{
LABEL_52:
if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, (ULONG_PTR)BugCheckParameter2, SessionId, 0i64);
}
else
{
*(_BYTE *)(v29 + 32) |= 2u;
if( *(__int64 *)(v29 + 32) < 0 )
KiAbEntryRemoveFromTree(v29);
v34[0] = *(_DWORD *)(v29 + 88) & 0x1FFFF;
*(_DWORD *)(v29 + 88) &= 0xFFFE0000;
*(_BYTE *)(v29 + 25) &= ~1u;
*(_QWORD *)(v29 + 32) = 0i64;
v30 = 1 << ((__int64)(v29 - *((_QWORD *)CurrentThread + 100)) / 96);
if( v26 == 1 )
*((_BYTE *)CurrentThread + 792) |= v30;
else
_InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, v30);
}
--*((_BYTE *)CurrentThread + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, (__int64)BugCheckParameter2, v34);
v20 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
if( v20 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
v13 = RtlpHpVaMgrRegionAllocate((INT64)BugCheckParameter2);
if( !v13 )
goto LABEL_9;
LOBYTE(v10) = RtlpHpAcquireLockExclusive((INT64 *)BugCheckParameter2, *((_BYTE *)BugCheckParameter2 + 46) & 1);
}
v15 = *(_QWORD *)(*((_QWORD *)BugCheckParameter2 + 3) + 8i64)
+ ((unsigned __int64)&v13[-*(_QWORD *)(*((_QWORD *)BugCheckParameter2 + 3) + 40i64)] >> *(_DWORD *)(*((_QWORD *)BugCheckParameter2 + 3) + 24i64) << 20);
*(_OWORD *)v13 = 0i64;
*((_QWORD *)v13 + 2) = 0i64;
*v13 = 1;
v13[1] = *((_BYTE *)BugCheckParameter2 + 44);
if( *((_WORD *)v13 + 12) > (unsigned __int16)v9 )
{
v16 = RtlpHpVaMgrRangeSplit((INT64)BugCheckParameter2, (INT64)v13, (unsigned __int16)v9);
RtlpHpVaMgrFree((INT64)BugCheckParameter2, v16);
}
v32 = v15;
if( (*((_BYTE *)BugCheckParameter2 + 46) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)BugCheckParameter2);
__writecr8((unsigned __int8)v10);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
v35 = 0;
v17 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)BugCheckParameter2) == 1 )
v12 = MmGetSessionIdEx(*((_QWORD *)v17 + 23));
--*((_WORD *)v17 + 243);
v18 = ++*((_BYTE *)v17 + 794);
v19 = (*((char *)v17 + 792) | *((char *)v17 + 870)) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v21, v19);
v34[1] = v21;
if( v20 )
break;
v22 = *((_QWORD *)v17 + 100) + 96 * v21;
v19 &= ~(1 << v21);
if( (*(_BYTE *)(v22 + 26) & 1) != 0
&& (*(_DWORD *)(v22 + 32) & 1) == 0
&& (*(_QWORD *)(v22 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)BugCheckParameter2 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v22 + 40) == v12 )
{
*(_BYTE *)(v22 + 26) &= ~1u;
if( *(_QWORD *)(v22 + 32) )
{
if( v22 )
{
*(_BYTE *)(v22 + 32) |= 2u;
if( *(__int64 *)(v22 + 32) < 0 )
KiAbEntryRemoveFromTree(v22);
v35 = *(_DWORD *)(v22 + 88) & 0x1FFFF;
*(_DWORD *)(v22 + 88) &= 0xFFFE0000;
*(_BYTE *)(v22 + 25) &= ~1u;
*(_QWORD *)(v22 + 32) = 0i64;
v23 = (__int64)(v22 - *((_QWORD *)v17 + 100)) / 96;
if( v18 == 1 )
*((_BYTE *)v17 + 792) |= 1 << v23;
else
_InterlockedOr8((volatile signed __int8 *)v17 + 870, 1 << v23);
goto LABEL_34;
}
break;
}
}
}
if( (*((_DWORD *)v17 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v17, (ULONG_PTR)BugCheckParameter2, v12, 0i64);
LABEL_34:
--*((_BYTE *)v17 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v17, (__int64)BugCheckParameter2, (unsigned int *)&v35);
v20 = (*((_WORD *)v17 + 243))++ == 0xFFFF;
if( v20 && *((_ETHREAD **)v17 + 19) != (_ETHREAD *)((char *)v17 + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
LABEL_9:
LODWORD(v7) = v32;
return v7;
}
if( v2 <= *((unsigned int *)&v41 + (((unsigned __int64)*((unsigned __int8 *)BugCheckParameter2 + 46) >> 1) & 3)) )
v3 = *((unsigned int *)&v41 + (((unsigned __int64)*((unsigned __int8 *)BugCheckParameter2 + 46) >> 1) & 3));
v36 = v4 - ((v3 - 1) & (v3 + v4 - 1)) + v3 - 1;
v7 = RtlpHpVaMgrAllocAligned((INT64)BugCheckParameter2, &v36, v3);
v32 = v7;
if( v7 )
{
v8 = *((_BYTE *)BugCheckParameter2 + 44);
*(_OWORD *)v38 = 0i64;
BYTE1(v38[0]) = v8;
v40 = (unsigned __int64)v36 >> 20;
v39 = 0i64;
LOBYTE(v38[0]) = 5;
if( RtlpHpVaMgrRangeCreate((INT64)BugCheckParameter2, v7, (INT64)v38) )
{
*v5 = v36;
goto LABEL_9;
}
RtlpHpEnvFreeVA(&v32, (UINT64 *)&v36, 0x8000i64);
LODWORD(v7) = 0;
}
return v7;
}Referenced by:
RtlpHpVaMgrCtxAlloc