MiMarkSystemVaAllocated

INT64 __fastcall MiMarkSystemVaAllocated(UINT64 a1, INT64 a2, INT64 a3, INT64 a4, INT64 a5){
  __int64 v5; 
  __int64 v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  INT64 *v9; 
  unsigned __int64 v10; 
  INT64 v11; 
  unsigned int v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  unsigned int v15; 
  __int64 v16; 
  __int64 *v17; 
  __int64 v18; 
  __int64 *v19; 
  bool v20; 
  bool i; 
  __int64 v22; 
  _ETHREAD *v23; 
  unsigned int SessionId; 
  char v25; 
  int v26; 
  unsigned __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  UINT32 v31; 
  int v32; 
  _ETHREAD *CurrentThread; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  unsigned int LogFileName; 
  int v36; 
  v36 = a4;
  LogFileName = a1;
  CurrentThread = 0i64;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v5 = 0i64;
  v6 = (_QWORD)MmGetPteBase() << 25;
  v7 = (a3 - a2) >> 3;
  v8 = ((((a2 << 25) - v6) >> 16 << 25) - v6) >> 16;
  if( (_DWORD)a1 == 1 )
  {
    v9 = 0i64;
    v10 = qword_140C4CAE0;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v5 = *(_QWORD *)(*((_QWORD *)CurrentThread + 23) + 1368i64);
    --*((_WORD *)CurrentThread + 243);
    v11 = v5 + 832;
    ExAcquirePushLockExclusiveEx(*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64) + 824i64, 0i64);
  }
  else
  {
    v9 = MiSystemVaToDynamicBitmap(a1);
    v11 = (INT64)v9;
    v10 = v9[4];
    KeAcquireInStackQueuedSpinLock((UINT64 *)v9 + 8, &LockHandle);
  }
  if( v8 < v10 )
    goto LABEL_5;
  v13 = (v8 - v10) >> 21;
  if( (_DWORD)a5 && (v14 = v13 + v7 - 1, v14 >= *(_QWORD *)v11) )
  {
    if( v14 >= v9[2]
      || (v15 = LogFileName,
          !MiExtendDynamicBitMap(
             (PHANDLE)v9,
             v11,
             (POBJECT_ATTRIBUTES)((v14 - *(_QWORD *)v11 + 0x8000) & 0xFFFFFFFFFFFF8000ui64),
             (PUNICODE_STRING)LogFileName,
             1u,
             v31)) )
    {
LABEL_5:
      v12 = 0;
      goto LABEL_33;
    }
  }
  else
  {
    v15 = LogFileName;
  }
  if( v36 == 1 )
  {
    if( v13 < *(_QWORD *)v11 )
    {
      if( v7 <= 1 )
      {
        if( v7 != 1 || _bittest64(*(const signed __int64 **)(v11 + 8), v13) )
          goto LABEL_17;
LABEL_27:
        RtlSetBitsEx(v11, v13, v7);
        v12 = 1;
        if( v5 )
        {
          *(_DWORD *)(v5 + 872) += v7;
          goto LABEL_33;
        }
        goto LABEL_32;
      }
      if( *(_QWORD *)v11 - v13 >= v7 )
      {
        v16 = *(_QWORD *)(v11 + 8);
        v17 = (__int64 *)(v16 + 8 * (v13 >> 6));
        v18 = *v17;
        v19 = (__int64 *)(v16 + 8 * ((v13 + v7 - 1) >> 6));
        if( v17 != v19 )
        {
          for( i = (v18 & (-1i64 << v13)) == 0; i; i = *v17 == 0 )
          {
            if( ++v17 == v19 )
            {
              v20 = ((0xFFFFFFFFFFFFFFFFui64 >> ~((unsigned __int8)v13 + (unsigned __int8)v7 - 1)) & *v17) == 0;
              goto LABEL_26;
            }
          }
          goto LABEL_17;
        }
        v20 = (v18 & (0xFFFFFFFFFFFFFFFFui64 >> (64 - (unsigned __int8)v7) << v13)) == 0;
LABEL_26:
        if( v20 )
          goto LABEL_27;
      }
    }
LABEL_17:
    v12 = 0;
    goto LABEL_33;
  }
  RtlClearBitsEx(v11, v13, v7);
  v12 = 1;
  if( v5 )
  {
    *(_DWORD *)(v5 + 872) -= v7;
    goto LABEL_33;
  }
  v7 = -(__int64)v7;
LABEL_32:
  _InterlockedExchangeAdd64((volatile signed __int64 *)&MiState[8 * v15 + 12424], v7);
LABEL_33:
  if( v5 )
  {
    v22 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64) + 824i64;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v22, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)v22);
    v32 = 0;
    v23 = (_ETHREAD *)KeGetCurrentThread();
    if( (unsigned int)MiGetSystemRegionType(v22) == 1 )
      SessionId = MmGetSessionIdEx(*((_QWORD *)v23 + 23));
    else
      SessionId = -1;
    --*((_WORD *)v23 + 243);
    v25 = ++*((_BYTE *)v23 + 794);
    v26 = (*((char *)v23 + 792) | *((char *)v23 + 870)) ^ 0x3F;
    while( 1 )
    {
      v20 = !_BitScanReverse((unsigned int *)&v28, v26);
      if( v20 )
        goto LABEL_46;
      v27 = *((_QWORD *)v23 + 100) + 96 * v28;
      v26 &= ~(1 << v28);
      if( (*(_BYTE *)(v27 + 26) & 1) != 0
        && (*(_DWORD *)(v27 + 32) & 1) == 0
        && (*(_QWORD *)(v27 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v22 & 0x7FFFFFFFFFFFFFFCi64)
        && *(_DWORD *)(v27 + 40) == SessionId )
      {
        *(_BYTE *)(v27 + 26) &= ~1u;
        if( *(_QWORD *)(v27 + 32) )
          break;
      }
    }
    if( !v27 )
    {
LABEL_46:
      if( (*((_DWORD *)v23 + 30) & 0x10000) == 0 )
        KeBugCheckEx(0x162u, (ULONG_PTR)v23, v22, SessionId, 0i64);
      goto LABEL_53;
    }
    *(_BYTE *)(v27 + 32) |= 2u;
    if( *(__int64 *)(v27 + 32) < 0 )
      KiAbEntryRemoveFromTree(v27);
    v32 = *(_DWORD *)(v27 + 88) & 0x1FFFF;
    *(_DWORD *)(v27 + 88) &= 0xFFFE0000;
    *(_BYTE *)(v27 + 25) &= ~1u;
    *(_QWORD *)(v27 + 32) = 0i64;
    v29 = (__int64)(v27 - *((_QWORD *)v23 + 100)) / 96;
    if( v25 == 1 )
      *((_BYTE *)v23 + 792) |= 1 << v29;
    else
      _InterlockedOr8((volatile signed __int8 *)v23 + 870, 1 << v29);
LABEL_53:
    --*((_BYTE *)v23 + 794);
    KiAbThreadRemoveBoosts((ULONG_PTR)v23, v22, (unsigned int *)&v32);
    v20 = (*((_WORD *)v23 + 243))++ == 0xFFFF;
    if( v20 && *((_ETHREAD **)v23 + 19) != (_ETHREAD *)((char *)v23 + 152) )
      KiCheckForKernelApcDelivery();
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
  else
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
  }
  return v12;
}

Referenced by: