SmpKeyedStoreEntryGet

INT64 __fastcall SmpKeyedStoreEntryGet(UINT64 P2, INT64 *a2, INT64 a3, INT64 a4){
  int v4; 
  _ETHREAD *CurrentThread; 
  unsigned int SessionId; 
  INT64 v9; 
  INT64 v10; 
  int v11; 
  __int64 v12; 
  INT64 v13; 
  _ETHREAD *v15; 
  char v16; 
  int v17; 
  bool v18; 
  __int64 v19; 
  unsigned __int64 v20; 
  __int64 v21; 
  UINT64 v22; 
  unsigned int v23; 
  unsigned int v24; 
  __int64 v25; 
  __int64 v26; 
  __int64 v27; 
  char *v28; 
  int v29; 
  _QWORD *i; 
  char j; 
  unsigned __int64 v32; 
  unsigned int v33; 
  __int64 v34; 
  __int64 v35; 
  _QWORD *v36; 
  __int64 v37; 
  struct _PRIVILEGE_SET *v38; 
  int v39; 
  INT64 v40; 
  __int64 v41; 
  INT64 v42; 
  INT64 v43; 
  INT64 v44; 
  int v45; 
  int v46; 
  v46 = a4;
  v45 = 0;
  v4 = a3;
  if( !(_DWORD)a4 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    if( (int)a3 > 0 )
      ExAcquirePushLockExclusiveEx(P2, 0i64);
    else
      ExAcquirePushLockSharedEx(P2, 0i64);
  }
  SessionId = -1;
  if( !v4 )
  {
    v9 = *(_QWORD *)(P2 + 24);
    if( v9 && *(_QWORD *)(v9 + 8) == *a2 )
      goto LABEL_17;
    if( *a2 == *(_QWORD *)(P2 + 32) )
    {
      v9 = 0i64;
      goto LABEL_17;
    }
  }
  v10 = *a2;
  v11 = *(_DWORD *)(P2 + 12) >> 5;
  v12 = -1i64 << (*(_BYTE *)(P2 + 12) & 0x1F);
  v13 = v12 & *a2;
  v40 = v13;
  if( !v11 )
    goto LABEL_15;
  v43 = v13;
  v9 = *(_QWORD *)(P2 + 16)
     + 8i64
     * ((37
       * (BYTE6(v40)
        + 37
        * (BYTE5(v40)
         + 37
         * (BYTE4(v40)
          + 37 * (BYTE3(v40) + 37 * (BYTE2(v40) + 37 * (BYTE1(v40) + 37 * ((unsigned __int8)v13 + 11623883)))))))
       + HIBYTE(v40)) & (unsigned int)(v11 - 1));
  while( 1 )
  {
    v9 = *(_QWORD *)v9;
    if( (v9 & 1) != 0 )
      break;
    if( v13 == (v12 & *(_QWORD *)(v9 + 8)) )
      goto LABEL_14;
  }
  v9 = 0i64;
LABEL_14:
  if( v9 )
  {
    if( v4 == 2 )
    {
      v29 = *(_DWORD *)(P2 + 12) >> 5;
      v40 = *(_QWORD *)(v9 + 8) & (-1i64 << (*(_DWORD *)(P2 + 12) & 0x1F));
      v44 = v40;
      for( i = (_QWORD *)(*(_QWORD *)(P2 + 16)
                         + 8i64
                         * ((37
                           * (BYTE6(v40)
                            + 37
                            * (BYTE5(v40)
                             + 37
                             * (BYTE4(v40)
                              + 37
                              * (BYTE3(v40)
                               + 37 * (BYTE2(v40) + 37 * (BYTE1(v40) + 37 * ((unsigned __int8)v40 + 11623883)))))))
                           + HIBYTE(v40)) & (unsigned int)(v29 - 1))); (*i & 1) == 0; i = (_QWORD *)*i )
      {
        if( *i == v9 )
        {
          *i = *(_QWORD *)v9;
          --*(_DWORD *)(P2 + 8);
          *(_QWORD *)v9 |= 0x8000000000000002ui64;
          break;
        }
      }
      if( *(_QWORD *)(P2 + 24) == v9 )
        *(_QWORD *)(P2 + 24) = 0i64;
    }
    else
    {
      *(_QWORD *)(P2 + 24) = v9;
    }
  }
  else
  {
LABEL_15:
    if( v4 != 1 )
    {
      *(_QWORD *)(P2 + 32) = v10;
      v9 = 0i64;
      goto LABEL_17;
    }
    v22 = P2 + 8;
    v45 = 1414032755;
    v23 = *(_DWORD *)(P2 + 12);
    v9 = (INT64)(a2 - 1);
    v24 = 2 * (v23 >> 5);
    if( *(_DWORD *)(P2 + 8) >= v24 )
    {
      v27 = v24;
      if( v24 < 4 )
        v27 = 4i64;
      v28 = (char *)SmAllocWrapper(8i64 * (unsigned int)v27, &v45);
      if( v28 )
      {
        if( (((_DWORD)v27 - 1) & (unsigned int)v27) != 0 )
        {
          for( j = -1; (_DWORD)v27; LODWORD(v27) = (unsigned int)v27 >> 1 )
            ++j;
          v27 = (unsigned int)(1 << j);
        }
        if( (unsigned int)v27 > 0x4000000 )
          v27 = 0x4000000i64;
        v32 = (unsigned int)v27;
        if( v28 > &v28[8 * v27] )
          v32 = 0i64;
        if( v32 )
          memset64(v28, v22 | 1, v32);
        v33 = 0;
        v34 = -1i64 << (*(_BYTE *)(P2 + 12) & 0x1F);
        if( (*(_DWORD *)(P2 + 12) & 0xFFFFFFE0) != 0 )
        {
          do
          {
            v35 = *(_QWORD *)(v22 + 8);
            while( 1 )
            {
              v36 = *(_QWORD **)(v35 + 8i64 * v33);
              if( ((unsigned __int8)v36 & 1) != 0 )
                break;
              *(_QWORD *)(v35 + 8i64 * v33) = *v36;
              v41 = v34 & v36[1];
              v37 = (37
                   * (BYTE6(v41)
                    + 37
                    * (BYTE5(v41)
                     + 37
                     * (BYTE4(v41)
                      + 37
                      * (BYTE3(v41) + 37 * (BYTE2(v41) + 37 * (BYTE1(v41) + 37 * ((unsigned __int8)v41 + 11623883)))))))
                   + HIBYTE(v41)) & (unsigned int)(v27 - 1);
              *v36 = *(_QWORD *)&v28[8 * v37];
              *(_QWORD *)&v28[8 * v37] = v36;
            }
            v22 = P2 + 8;
            ++v33;
          }
          while( v33 < *(_DWORD *)(P2 + 12) >> 5 );
        }
        v38 = *(struct _PRIVILEGE_SET **)(v22 + 8);
        v23 = *(_DWORD *)(v22 + 4) & 0x1F | (32 * v27);
        *(_QWORD *)(v22 + 8) = v28;
        *(_DWORD *)(v22 + 4) = v23;
        if( v38 )
        {
          CmSiFreeMemory(v38);
          v23 = *(_DWORD *)(P2 + 12);
        }
      }
      else
      {
        v23 = *(_DWORD *)(P2 + 12);
        if( v23 < 0x20 )
        {
          v9 = 0i64;
          SessionId = -1;
          goto LABEL_17;
        }
      }
    }
    v42 = *a2 & (-1i64 << (v23 & 0x1F));
    v25 = *(_QWORD *)(v22 + 8);
    v26 = (37
         * (BYTE6(v42)
          + 37
          * (BYTE5(v42)
           + 37
           * (BYTE4(v42)
            + 37 * (BYTE3(v42) + 37 * (BYTE2(v42) + 37 * (BYTE1(v42) + 37 * ((unsigned __int8)v42 + 11623883)))))))
         + HIBYTE(v42)) & ((v23 >> 5) - 1);
    *(_QWORD *)v9 = *(_QWORD *)(v25 + 8 * v26);
    *(_QWORD *)(v25 + 8 * v26) = v9;
    ++*(_DWORD *)v22;
    SessionId = -1;
    if( *(_QWORD *)(P2 + 32) == *a2 )
      *(_QWORD *)(P2 + 32) = 0i64;
  }
LABEL_17:
  if( !v46 )
  {
    if( v4 > 0 )
    {
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)P2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)P2);
      v39 = 0;
      v15 = (_ETHREAD *)KeGetCurrentThread();
      if( (unsigned int)MiGetSystemRegionType(P2) == 1 )
        SessionId = MmGetSessionIdEx(*((_QWORD *)v15 + 23));
      --*((_WORD *)v15 + 243);
      v16 = ++*((_BYTE *)v15 + 794);
      v17 = (*((char *)v15 + 792) | *((char *)v15 + 870)) ^ 0x3F;
      while( 1 )
      {
        v18 = !_BitScanReverse((unsigned int *)&v19, v17);
        if( v18 )
          break;
        v20 = *((_QWORD *)v15 + 100) + 96 * v19;
        v17 &= ~(1 << v19);
        if( (*(_BYTE *)(v20 + 26) & 1) != 0
          && (*(_DWORD *)(v20 + 32) & 1) == 0
          && (*(_QWORD *)(v20 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (P2 & 0x7FFFFFFFFFFFFFFCi64)
          && *(_DWORD *)(v20 + 40) == SessionId )
        {
          *(_BYTE *)(v20 + 26) &= ~1u;
          if( *(_QWORD *)(v20 + 32) )
          {
            if( v20 )
            {
              *(_BYTE *)(v20 + 32) |= 2u;
              if( *(__int64 *)(v20 + 32) < 0 )
                KiAbEntryRemoveFromTree(v20);
              v39 = *(_DWORD *)(v20 + 88) & 0x1FFFF;
              *(_DWORD *)(v20 + 88) &= 0xFFFE0000;
              *(_BYTE *)(v20 + 25) &= ~1u;
              *(_QWORD *)(v20 + 32) = 0i64;
              v21 = (__int64)(v20 - *((_QWORD *)v15 + 100)) / 96;
              if( v16 == 1 )
                *((_BYTE *)v15 + 792) |= 1 << v21;
              else
                _InterlockedOr8((volatile signed __int8 *)v15 + 870, 1 << v21);
              goto LABEL_45;
            }
            break;
          }
        }
      }
      if( (*((_DWORD *)v15 + 30) & 0x10000) == 0 )
        KeBugCheckEx(0x162u, (ULONG_PTR)v15, P2, SessionId, 0i64);
LABEL_45:
      --*((_BYTE *)v15 + 794);
      KiAbThreadRemoveBoosts((ULONG_PTR)v15, P2, (unsigned int *)&v39);
      v18 = (*((_WORD *)v15 + 243))++ == 0xFFFF;
      if( v18 && *((_ETHREAD **)v15 + 19) != (_ETHREAD *)((char *)v15 + 152) )
        KiCheckForKernelApcDelivery();
    }
    else
    {
      if( _InterlockedCompareExchange64((volatile signed __int64 *)P2, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((INT64 *)P2);
      KeAbPostRelease((PVOID)P2);
    }
    KeLeaveCriticalRegion();
  }
  return v9;
}

Referenced by: