RtlpFindAndCommitPages

UINT64 __fastcall RtlpFindAndCommitPages(INT64 a1, UINT64 *a2){
  __int64 *UCREntry; 
  __int64 *v5; 
  INT64 v6; 
  UINT64 v7; 
  char v8; 
  __int64 v9; 
  unsigned __int64 v10; 
  int v11; 
  void *v12; 
  UINT64 v13; 
  UINT64 v15; 
  UINT64 v16; 
  INT64 v17; 
  UINT64 AllocationType; 
  UINT64 Protect; 
  PVOID BaseAddress; 
  UCREntry = RtlpFindUCREntry(a1, *a2);
  v5 = UCREntry;
  if( UCREntry == (__int64 *)(a1 + 240) )
    return 0i64;
  if( RtlpHeapErrorHandlerThreshold >= 1 && UCREntry[5] < *a2 )
  {
    DbgPrint("(UCRBlock->Size >= *Size)");
    RtlpHeapHandleError(v6);
  }
  v7 = (UINT64)(UCREntry - 2);
  v8 = 0;
  v9 = *((unsigned __int8 *)UCREntry - 2);
  if( (_BYTE)v9 )
    v10 = (v7 & 0xFFFFFFFFFFFF0000ui64) - (v9 << 16) + 0x10000;
  else
    v10 = a1;
  BaseAddress = (PVOID)v5[4];
  if( RtlpHeapKey != *(_QWORD *)(a1 + 360) )
  {
    v11 = ((__int64(__fastcall *)(INT64, PVOID *, UINT64 *))(RtlpHeapKey ^ *(_QWORD *)(a1 + 360)))(
            a1,
            &BaseAddress,
            a2);
  }
  else
  {
    v13 = (*a2 + 4095) & 0xFFFFFFFFFFFFF000ui64;
    *a2 = v13;
    if( (unsigned int)RtlpHpHeapCheckCommitLimit(
                         v13,
                         *(_QWORD *)(a1 + 576) - *(_QWORD *)(a1 + 664),
                         a1,
                         (UINT64 *)(a1 + 376)) )
    {
      LODWORD(Protect) = 4;
      LODWORD(AllocationType) = 4096;
      ZwAllocateVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, &BaseAddress, 0i64, a2, AllocationType, Protect);
    }
    RtlpUpdateHeapRates((_DWORD *)a1, 2);
  }
  if( v11 < 0 )
  {
    ++*(_DWORD *)(a1 + 632);
    return 0i64;
  }
  if( *(_DWORD *)(a1 + 124) )
  {
    *(_DWORD *)(v7 + 8) ^= *(_DWORD *)(a1 + 136);
    LOBYTE(v12) = *(_BYTE *)(v7 + 8) ^ *(_BYTE *)(v7 + 9) ^ *(_BYTE *)(v7 + 10);
    if( *(_BYTE *)(v7 + 11) != (_BYTE)v12 )
      RtlpAnalyzeHeapFailure(a1, v7);
  }
  *(_BYTE *)(v7 + 10) = 0;
  *(_BYTE *)(v7 + 15) = 0;
  RtlpRemoveUCRBlock(v12, v5);
  --*(_DWORD *)(v10 + 84);
  *(_DWORD *)(v10 + 80) -= (unsigned __int64)v5[5] >> 12;
  *(_QWORD *)(a1 + 576) += v5[5];
  ++*(_DWORD *)(a1 + 608);
  --*(_DWORD *)(a1 + 604);
  v15 = v5[5];
  if( v15 >= 0xFF000 )
  {
    *(_QWORD *)(a1 + 584) -= v15;
    v15 = v5[5];
  }
  v16 = *a2;
  if( v15 > *a2 || v15 + v5[4] == *(_QWORD *)(v10 + 72) )
  {
    RtlpCreateUCREntry(a1, v10, v16 - 48 + v5[4], v15 - v16, v7, (INT64 *)a2);
    *a2 *= 16i64;
  }
  else
  {
    *a2 = v16 + 16i64 * *(unsigned __int16 *)(v7 + 8);
  }
  *(_BYTE *)(v7 + 11) = 0;
  v17 = *(_QWORD *)(v10 + 40);
  if( v17 != v10 )
  {
    if( ((v7 - v10) >> 16) + 1 >= 0xFE )
      RtlpLogHeapFailure(3i64, v17, v7, v10, 0i64, 0i64);
    v8 = ((unsigned int)(v7 - v10) >> 16) + 1;
  }
  *(_BYTE *)(v7 + 14) = v8;
  return v7;
}

Referenced by: