RtlCreateHeap
VOID *__fastcall RtlCreateHeap(
UINT64 Flags,
VOID *HeapBase,
UINT64 ReserveSize,
UINT64 CommitSize,
VOID *Lock,
_RTL_HEAP_PARAMETERS *Parameters){
unsigned int v9;
ULONG_PTR CommitRoutine;
UINT64 v11;
INT64 v12;
__int64 v13;
NTSTATUS(__fastcall *v14)(__int64, PVOID *, ULONG_PTR *);
int v15;
VOID *v16;
VOID *v17;
unsigned int v19;
INT64 v20;
int v21;
int v22;
int v23;
SIZE_T SegmentReserve;
SIZE_T SegmentCommit;
SIZE_T DeCommitFreeBlockThreshold;
SIZE_T DeCommitTotalFreeThreshold;
__int64 v28;
SIZE_T VirtualMemoryThreshold;
ULONG_PTR v30;
int v31;
unsigned int v32;
char *v33;
ULONG_PTR v34;
char *v35;
INT64 v36;
unsigned __int64 v37;
unsigned int v38;
_QWORD *v39;
_QWORD *v40;
_QWORD *v41;
_QWORD *v42;
_DWORD *v43;
VOID *MemoryInformationLength;
PSIZE_T ReturnLength;
PVOID v46;
unsigned __int64 v47;
ULONG_PTR InitialReserve;
INT64 v49;
ULONG_PTR v50;
PVOID v51;
ULONG_PTR RegionSize;
ULONG_PTR v53;
PVOID BaseAddress;
__int64 v55;
SIZE_T MaximumAllocationSize;
SIZE_T v57;
SIZE_T v58;
unsigned __int64 v59;
__int64 v60[2];
__int128 MemoryInformation;
__int128 v62;
__int128 v63;
__int128 a1;
_RTL_HEAP_PARAMETERS result;
__int128 v66;
__int128 v67;
__int128 v68;
char SystemInformation[40];
__int64 v70;
v9 = Flags;
v47 = (unsigned __int64)Lock;
v55 = (__int64)HeapBase;
RegionSize = (ULONG_PTR)Lock;
v51 = 0i64;
LODWORD(InitialReserve) = NtGlobalFlag;
MemoryInformation = 0i64;
v62 = 0i64;
v63 = 0i64;
v66 = 0i64;
v67 = 0i64;
v68 = 0i64;
LODWORD(v49) = 0;
v50 = 0i64;
memset((INT64)SystemInformation, 0i64);
v46 = 0i64;
v13 = 0i64;
if( (v9 & 0x100) == 0 )
{
if( (v9 & 0x200) != 0 )
goto LABEL_14;
if( (v9 & 0x10000000) == 0 )
{
v19 = v9 & 0xFFF80C00;
if( RtlpHeapErrorHandlerThreshold < 2 )
{
if( v19 )
v9 &= 0x7F3FFu;
}
else if( v19 )
{
DbgPrint("!(CheckedFlags & ~HEAP_CREATE_VALID_MASK)");
RtlpHeapHandleError(v20);
}
}
memset((INT64)&result, 0i64);
if( Parameters && Parameters->Length == 96 )
result = *Parameters;
v21 = v9 | 0x20;
if( (InitialReserve & 0x10) == 0 )
v21 = v9;
v22 = v21 | 0x40;
if( (InitialReserve & 0x20) == 0 )
v22 = v21;
v23 = v22 | 0x80;
if( (InitialReserve & 0x200000) == 0 )
v23 = v22;
SegmentReserve = result.SegmentReserve;
if( !result.SegmentReserve )
SegmentReserve = qword_140CFA1B8;
v57 = SegmentReserve;
SegmentCommit = result.SegmentCommit;
if( !result.SegmentCommit )
SegmentCommit = qword_140CFA1B0;
v58 = SegmentCommit;
DeCommitFreeBlockThreshold = result.DeCommitFreeBlockThreshold;
if( !result.DeCommitFreeBlockThreshold )
DeCommitFreeBlockThreshold = qword_140CFA1A0;
v59 = DeCommitFreeBlockThreshold;
DeCommitTotalFreeThreshold = result.DeCommitTotalFreeThreshold;
if( !result.DeCommitTotalFreeThreshold )
DeCommitTotalFreeThreshold = qword_140CFA1A8;
*(_QWORD *)&a1 = DeCommitTotalFreeThreshold;
v28 = qword_140CF9D28;
if( !qword_140CF9D28 )
{
qword_140CF9D30 = 0x10000i64;
if( (int)ZwQuerySystemInformation() < 0 )
goto LABEL_14;
v28 = v70;
qword_140CF9D28 = v70;
}
MaximumAllocationSize = result.MaximumAllocationSize;
v11 = 4096i64;
if( !result.MaximumAllocationSize )
MaximumAllocationSize = v28 - qword_140CF9D30 - 4096;
VirtualMemoryThreshold = result.VirtualMemoryThreshold;
if( result.VirtualMemoryThreshold - 1 > 0xFEFFF )
VirtualMemoryThreshold = 1044480i64;
v60[0] = VirtualMemoryThreshold;
if( CommitSize )
CommitRoutine = (CommitSize + 0x1FFF) & 0xFFFFFFFFFFFFE000ui64;
else
CommitRoutine = 0x2000i64;
v50 = CommitRoutine;
if( ReserveSize )
v30 = (ReserveSize + 0x1FFF) & 0xFFFFFFFFFFFFE000ui64;
else
v30 = (CommitRoutine + 0xFFFF) & 0xFFFFFFFFFFFF0000ui64;
InitialReserve = v30;
if( CommitRoutine > v30 )
{
v50 = v30;
CommitRoutine = v30;
}
if( (v23 & 2) == 0 || HeapBase )
{
v55 = 0i64;
}
else
{
v55 = 4096i64;
LODWORD(v49) = 2;
if( v30 - 4096 < CommitRoutine )
{
v30 = (v30 + 69631) & 0xFFFFFFFFFFFF0000ui64;
InitialReserve = v30;
}
}
if( !CommitRoutine || !v30 )
goto LABEL_14;
v31 = 704;
v17 = (VOID *)v47;
v32 = v23;
if( (v23 & 1) != 0 )
{
if( v47 )
goto LABEL_73;
}
else
{
v31 = v47 != 0 ? 704 : 808;
v32 = v23 | 0x80000000;
if( !v47 )
v32 = v23;
v13 = v47 & -(__int64)(v47 != 0);
}
if( HeapBase )
{
if( result.CommitRoutine )
{
if( !result.InitialCommit
|| !result.InitialReserve
|| result.InitialCommit > result.InitialReserve
|| (v32 & 2) != 0 )
{
goto LABEL_14;
}
v51 = HeapBase;
v33 = (char *)HeapBase + result.InitialCommit;
InitialReserve = result.InitialReserve;
memset((INT64)HeapBase, 0i64);
v11 = (UINT64)HeapBase;
}
else
{
if( ZwQueryVirtualMemory(
(PVOID)0xFFFFFFFFFFFFFFFFi64,
HeapBase,
MemoryBasicInformation,
&MemoryInformation,
0x30ui64,
0i64) < 0 )
goto LABEL_14;
v33 = (char *)MemoryInformation;
if( (VOID *)MemoryInformation != HeapBase || (_DWORD)v63 == 0x10000 )
goto LABEL_14;
v11 = MemoryInformation;
v51 = (PVOID)MemoryInformation;
if( (_DWORD)v63 == 4096 )
{
if( (v32 & 0x40000) != 0 && (BYTE4(v63) & 0x40) == 0 )
goto LABEL_14;
memset(MemoryInformation, 0i64);
if( ZwQueryVirtualMemory(
(PVOID)0xFFFFFFFFFFFFFFFFi64,
HeapBase,
MemoryBasicVlmInformation,
&v66,
0x30ui64,
0i64) < 0 )
goto LABEL_14;
InitialReserve = v67;
v50 = *((_QWORD *)&v62 + 1);
v11 = (UINT64)v51;
v33 = (char *)v51 + *((_QWORD *)&v62 + 1);
}
else
{
InitialReserve = *((_QWORD *)&v62 + 1);
v34 = v50;
if( v50 > *((_QWORD *)&v62 + 1) )
v34 = *((_QWORD *)&v62 + 1);
v50 = v34;
if( v34 < 0x2000 )
goto LABEL_14;
}
}
LODWORD(v49) = v49 | 1;
v35 = (char *)HeapBase;
v46 = HeapBase;
goto LABEL_93;
}
BaseAddress = 0i64;
if( !result.CommitRoutine )
{
v53 = (RtlpHeapGenerateRandomValue64() & 0x1F) << 16;
RegionSize = InitialReserve + v53;
if( InitialReserve + v53 < InitialReserve )
{
RegionSize = InitialReserve;
v53 = 0i64;
}
LODWORD(ReturnLength) = 4;
LODWORD(MemoryInformationLength) = 0x2000;
if( ZwAllocateVirtualMemory(
(PVOID)0xFFFFFFFFFFFFFFFFi64,
&BaseAddress,
0i64,
&RegionSize,
(UINT64)MemoryInformationLength,
(UINT64)ReturnLength) < 0 )
goto LABEL_14;
v35 = (char *)BaseAddress;
v46 = BaseAddress;
InitialReserve = RegionSize;
if( v53 )
{
ZwFreeVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, &BaseAddress, &v53, 0x8000ui64);
v35 = (char *)BaseAddress + v53;
v46 = (char *)BaseAddress + v53;
InitialReserve = RegionSize - v53;
}
v11 = (UINT64)v35;
v51 = v35;
v33 = v35;
LABEL_93:
if( (char *)v11 != v33 )
goto LABEL_96;
LODWORD(ReturnLength) = 4;
LODWORD(MemoryInformationLength) = 4096;
if( ZwAllocateVirtualMemory(
(PVOID)0xFFFFFFFFFFFFFFFFi64,
&v51,
0i64,
&v50,
(UINT64)MemoryInformationLength,
(UINT64)ReturnLength) >= 0 )
{
v33 += v50;
v35 = (char *)v46;
LABEL_96:
v36 = (INT64)(v35 + 704);
if( (NtGlobalFlag & 0x800) != 0 )
{
v37 = (unsigned __int64)(v35 + 711) & 0xFFFFFFFFFFFFFFF8ui64;
*((_QWORD *)v35 + 41) = v37;
v31 += 2064;
v36 = v37 + 2064;
v32 |= 0x4000000u;
v35 = (char *)v46;
}
v38 = (v31 + 15) & 0xFFFFFFF0;
*((_WORD *)v35 + 4) = v38 >> 4;
*((_BYTE *)v46 + 10) = 1;
*((_BYTE *)v46 + 15) = 1;
*((_DWORD *)v46 + 38) = -285217025;
*((_DWORD *)v46 + 28) = v32 & 0xEFFFFFFF;
*((_DWORD *)v46 + 36) = 0;
memset((INT64)v46 + 568, 0i64);
RtlpCreateHeapEncoding((__int64)v46);
*((_DWORD *)v46 + 29) = v32 & 0x6001007D;
*((_WORD *)v46 + 105) = v36 - (_WORD)v46;
*((_QWORD *)v46 + 27) = 0i64;
v39 = (char *)v46 + 336;
*((_QWORD *)v46 + 43) = (char *)v46 + 336;
*v39 = v39;
v40 = (char *)v46 + 272;
*((_QWORD *)v46 + 35) = (char *)v46 + 272;
*v40 = v40;
v41 = (char *)v46 + 288;
*((_QWORD *)v46 + 37) = (char *)v46 + 288;
*v41 = v41;
v42 = (char *)v46 + 240;
*((_QWORD *)v46 + 31) = (char *)v46 + 240;
*v42 = v42;
if( !v13 && (v32 & 1) == 0 )
{
v13 = v36;
if( ExInitializeResourceLite((PERESOURCE)v36) < 0 )
{
v13 = 0i64;
goto LABEL_14;
}
v36 += 104i64;
}
*((_QWORD *)v46 + 44) = v13;
*((_DWORD *)v46 + 30) |= 0x80000000;
LODWORD(MemoryInformationLength) = v49;
if( RtlpInitializeHeapSegment(
(INT64)v46,
(INT64)v46,
v38 + 1104,
v12,
(INT64)MemoryInformationLength,
(INT64)v51,
(UINT64)v33,
(UINT64)v51 + InitialReserve - v55) )
{
if( HeapBase )
memset(v36, 0i64);
*(_DWORD *)(v36 + 8) = 128;
*(_QWORD *)(v36 + 40) = v36 + 56;
*(_QWORD *)(v36 + 32) = (char *)v46 + 336;
*(_QWORD *)(v36 + 48) = v36 + 72;
RtlpPopulateListIndex((INT64)v46, v36);
*((_WORD *)v46 + 104) = 0;
*((_QWORD *)v46 + 20) = v57;
*((_QWORD *)v46 + 21) = v58;
*((_QWORD *)v46 + 22) = v59 >> 4;
*((_QWORD *)v46 + 23) = (unsigned __int64)a1 >> 4;
*((_QWORD *)v46 + 25) = MaximumAllocationSize;
*((_DWORD *)v46 + 37) = (unsigned __int64)(v60[0] + 15) >> 4;
*((_QWORD *)v46 + 45) = RtlpHeapKey ^ (__int64)result.CommitRoutine;
*((_DWORD *)v46 + 172) = 4;
*((_QWORD *)v46 + 87) = 2088960i64;
*((_QWORD *)v46 + 32) = 31i64;
*((_QWORD *)v46 + 33) = -16i64;
v43 = v46;
if( (*((_DWORD *)v46 + 28) & 0x20) != 0 )
{
*((_QWORD *)v46 + 32) += 16i64;
v43 = v46;
}
v43[30] &= ~0x80000000;
v16 = v46;
v46 = 0i64;
v13 = 0i64;
goto LABEL_10;
}
}
LABEL_14:
v16 = 0i64;
goto LABEL_10;
}
LABEL_73:
v16 = 0i64;
goto LABEL_11;
}
if( !HeapBase )
goto LABEL_14;
if( v47 )
goto LABEL_14;
if( (v9 & 2) != 0 )
goto LABEL_14;
v11 = (unsigned int)RtlpHpConvertCreationFlags(v9, InitialReserve);
CommitRoutine = (ULONG_PTR)Parameters->CommitRoutine;
if( CommitRoutine )
{
CommitSize = Parameters->InitialCommit;
if( !CommitSize )
goto LABEL_14;
ReserveSize = Parameters->InitialReserve;
if( !ReserveSize || CommitSize > ReserveSize )
goto LABEL_14;
}
*(_OWORD *)v60 = *RtlpHpLegacyGetEnvHandle(&a1);
v16 = (VOID *)RtlpHpFixedHeapCreate(HeapBase, v14, ReserveSize, CommitSize, v15, (__int64)v60);
LABEL_10:
v17 = (VOID *)v47;
LABEL_11:
if( v13 && (VOID *)v13 != v17 )
ExDeleteResourceLite(v13, (UINT64 *)CommitRoutine, v11, v12, MemoryInformationLength);
if( v46 && !HeapBase )
{
InitialReserve = 0i64;
ZwFreeVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, &v46, &InitialReserve, 0x8000ui64);
}
return v16;
}Referenced by:
No references.