RtlpHpLargeAlloc
INT64 __fastcall RtlpHpLargeAlloc(INT64 a1, INT16 dx0, UINT64 r8_0, CHAR r9_0){
__int128 v4;
INT64 v5;
_OWORD *v8;
int v9;
unsigned int v10;
INT64 v11;
UINT64 v12;
int v13;
INT64 v14;
CHAR v15;
int v16;
unsigned __int64 v17;
UINT64 v18;
unsigned __int64 v19;
UINT8 v20;
unsigned __int64 *v21;
unsigned __int64 v22;
unsigned __int64 v23;
bool v24;
unsigned __int64 v25;
INT64 v26;
_ETHREAD *CurrentThread;
unsigned int SessionId;
char v30;
int v31;
bool v32;
__int64 v33;
unsigned __int64 v34;
__int64 v35;
ULONG_PTR BugCheckParameter4;
ULONG_PTR BugCheckParameter4a;
INT64 result;
size_t a2;
int v40;
int v41;
__int64 v42;
INT64 *a3;
__int64 a4;
__int128 a4_8;
__int128 a6;
__int128 v47;
INT64 v48[2];
__int128 v49;
__int128 v50;
__int128 v51;
__int128 v52;
__int128 v53;
__int128 v54;
__int128 v55;
__int128 v56;
__int128 v57;
UINT64 v58;
v4 = *(_OWORD *)a1;
a2 = 0i64;
LODWORD(v42) = 0;
v5 = 0i64;
a3 = 0i64;
v41 = 0;
result = 0i64;
a4_8 = v4;
v8 = RtlpHpMetadataAlloc(0x28ui64, 0x28ui64, 0, &a4_8);
if( v8 )
{
*v8 = 0i64;
v9 = 0;
v8[1] = 0i64;
*((_QWORD *)v8 + 4) = 0i64;
if( (*(_DWORD *)(a1 + 20) & 0x4000000) != 0 && 0x1FFFFF - ((r8_0 - 1) & 0x1FFFFF) < r8_0 >> 2 )
v9 = 1;
while( 1 )
{
v10 = 0;
if( v9 )
{
v11 = 0x200000i64;
v12 = r8_0 - ((r8_0 - 1) & 0x1FFFFF) + 0x1FFFFF;
}
else
{
LOBYTE(v10) = BYTE1(*(_QWORD *)a1) < 2u;
v11 = 0i64;
v12 = r8_0 + (v10 << 12);
}
a2 = v12;
if( v12 < r8_0 )
break;
v13 = *(_DWORD *)(a1 + 20) & 0x40000000;
a6 = *(_OWORD *)a1;
v52 = 0i64;
v53 = 0i64;
v54 = 0i64;
if( v13 )
{
*(_QWORD *)&v52 = a1;
DWORD2(v52) = 64;
}
LODWORD(BugCheckParameter4) = v13 != 0 ? 64 : 4;
if( (int)RtlpHpAllocVA(&result, &a2, v11, 0x2000i64, BugCheckParameter4, (INT64)&a6) < 0 )
{
result = 0i64;
break;
}
v47 = *(_OWORD *)a1;
RtlpHpQueryVA(result, &v47, &a3, &v41);
*a3 = a1;
v58 = (r8_0 + 4095) >> 12;
a4 = v58 << 12;
if( !(unsigned int)RtlpHpSegHeapCheckCommitLimit(v58 << 12, (UINT64 *)a1) )
break;
if( v9 )
{
v14 = 536875008i64;
a4 = (v58 << 12) - (((v58 << 12) - 1) & 0x1FFFFF) + 0x1FFFFF;
v15 = r9_0;
}
else
{
v15 = r9_0;
v14 = 4096i64;
if( (r9_0 & 2) != 0 )
v14 = 1073745920i64;
}
v16 = *(_DWORD *)(a1 + 20) & 0x40000000;
*(_OWORD *)v48 = *(_OWORD *)a1;
v55 = 0i64;
v56 = 0i64;
v57 = 0i64;
if( v16 )
{
*(_QWORD *)&v55 = a1;
DWORD2(v55) = 64;
}
LODWORD(BugCheckParameter4a) = v16 != 0 ? 64 : 4;
if( (int)RtlpHpAllocVA(&result, (size_t *)&a4, 0i64, v14, BugCheckParameter4a, (INT64)v48) >= 0 )
{
if( v9 && (v15 & 2) != 0 )
memset(result, 0i64);
v17 = (r8_0 + 4095) >> 12;
*((_QWORD *)v8 + 3) = result;
v18 = v8[2] & 0xFFD | (2 * (v10 | (v58 << 11)));
*((_QWORD *)v8 + 4) = v18;
_BitScanForward64(&v19, a2);
LODWORD(v42) = v19;
*((_QWORD *)v8 + 4) = v18 ^ (unsigned __int8)(v18 ^ (4 * v19)) & 0xFC;
*((_WORD *)v8 + 12) = ((_WORD)v58 << 12) - dx0;
v20 = RtlpHpLargeLockAcquire(a1, v15);
v21 = (unsigned __int64 *)(a1 + 72);
v22 = v20;
if( (*(_BYTE *)(a1 + 80) & 1) != 0 )
{
if( *v21 )
v23 = *v21 ^ (unsigned __int64)v21;
else
v23 = 0i64;
}
else
{
v23 = *v21;
}
v24 = 0;
if( v23 )
{
while( 1 )
{
if( result < (*(_QWORD *)(v23 + 24) & 0xFFFFFFFFFFFF0000ui64) )
{
v25 = *(_QWORD *)v23;
if( (*(_BYTE *)(a1 + 80) & 1) != 0 )
{
if( !v25 )
break;
v25 ^= v23;
}
if( !v25 )
break;
}
else
{
v25 = *(_QWORD *)(v23 + 8);
if( (*(_BYTE *)(a1 + 80) & 1) != 0 )
{
if( !v25 )
goto LABEL_34;
v25 ^= v23;
}
if( !v25 )
{
LABEL_34:
v24 = 1;
break;
}
}
v23 = v25;
}
}
RtlRbInsertNodeEx(v21, v23, v24, (unsigned __int64)v8);
if( (v15 & 1) == 0 )
{
v26 = a1 + 64;
if( (*(_DWORD *)a1 & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a1 + 64));
__writecr8(v22);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v26, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)(a1 + 64));
v40 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(a1 + 64) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
else
SessionId = -1;
--*((_WORD *)CurrentThread + 243);
v30 = ++*((_BYTE *)CurrentThread + 794);
v31 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
while( 1 )
{
v32 = !_BitScanReverse((unsigned int *)&v33, v31);
if( v32 )
break;
v34 = *((_QWORD *)CurrentThread + 100) + 96 * v33;
v31 &= ~(1 << v33);
if( (*(_BYTE *)(v34 + 26) & 1) != 0
&& (*(_DWORD *)(v34 + 32) & 1) == 0
&& (*(_QWORD *)(v34 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v26 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v34 + 40) == SessionId )
{
*(_BYTE *)(v34 + 26) &= ~1u;
if( *(_QWORD *)(v34 + 32) )
{
if( v34 )
{
*(_BYTE *)(v34 + 32) |= 2u;
if( *(__int64 *)(v34 + 32) < 0 )
KiAbEntryRemoveFromTree(v34);
v40 = *(_DWORD *)(v34 + 88) & 0x1FFFF;
*(_DWORD *)(v34 + 88) &= 0xFFFE0000;
*(_BYTE *)(v34 + 25) &= ~1u;
*(_QWORD *)(v34 + 32) = 0i64;
v35 = (__int64)(v34 - *((_QWORD *)CurrentThread + 100)) / 96;
if( v30 == 1 )
*((_BYTE *)CurrentThread + 792) |= 1 << v35;
else
_InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, 1 << v35);
goto LABEL_67;
}
break;
}
}
}
if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, a1 + 64, SessionId, 0i64);
LABEL_67:
--*((_BYTE *)CurrentThread + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, a1 + 64, (unsigned int *)&v40);
v32 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
if( v32 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
}
_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 88), (__int64)a2 / 4096);
_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 96), v17);
v5 = result;
v8 = 0i64;
result = 0i64;
break;
}
if( !v9 )
break;
v9 = 0;
v49 = *(_OWORD *)a1;
RtlpHpFreeVA((UINT64 *)&result, &a2, 0x8000i64, &v49);
result = 0i64;
}
if( v8 )
{
v50 = *(_OWORD *)a1;
RtlpHpMetadataFree((__int64)v8, &v50);
}
}
if( result )
{
v51 = *(_OWORD *)a1;
RtlpHpFreeVA((UINT64 *)&result, &a2, 0x8000i64, &v51);
}
return v5;
}Referenced by:
ExAllocateHeapPool
RtlpHpAllocateHeapInternal