MiSelectOverflowDllBase

INT64 __fastcall MiSelectOverflowDllBase(INT64 a1, UINT64 a2){
  unsigned __int64 v3; 
  int v4; 
  BOOL CanUseHighOverflowArea; 
  unsigned __int64 v6; 
  unsigned int v7; 
  __int64 *v9; 
  __int64 v10; 
  INT64 *v11; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v13; 
  INT64 v14; 
  v3 = ((*(_DWORD *)(a1 + 8) << 12) + 0xFFFF) & 0xFFFF0000;
  CanUseHighOverflowArea = MiImageCanUseHighOverflowArea(a1, a2);
  v6 = CanUseHighOverflowArea ? 0x10000000i64 : 0x4000000i64;
  if( v3 <= v6 )
  {
    v9 = &qword_140C4C8A8;
    if( v4 == 3 )
      v9 = qword_140C4C8D8;
    v10 = *v9;
    v11 = v9 + 1;
    if( CanUseHighOverflowArea )
    {
      v10 = v9[2];
      v11 = v9 + 3;
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v13 = v6 + v10;
    --*((_WORD *)CurrentThread + 243);
    ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4C888, 0i64);
    v14 = v10;
    if( v3 <= v13 - *v11 )
      v14 = *v11;
    *v11 = v14 + v3;
    if( v14 + v3 == v13 )
      *v11 = v10;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4C888, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)&qword_140C4C888);
    KeAbPostRelease(&qword_140C4C888);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    return v14;
  }
  else
  {
    v7 = (unsigned __int8)ExGenRandom(1i64) << 16;
    if( a2 < 0x1010000 || a2 > v3 + a2 || v3 + a2 > 0x7FFFFFFF0000i64 )
      return v7 + 0x10000i64;
    else
      return a2 - v7;
  }
}

Referenced by: