RtlpHpLfhSubsegmentDecommitPages

UINT64 __fastcall RtlpHpLfhSubsegmentDecommitPages(INT64 a1, INT64 a2, INT64 r8_0, UINT64 a4, CHAR a5){
  unsigned int v5; 
  unsigned int v6; 
  int v9; 
  int v10; 
  __int64 v11; 
  __int64 v12; 
  UINT64 result; 
  unsigned __int64 v14; 
  UINT64 v15; 
  INT64 v16; 
  char v17; 
  unsigned int v18; 
  unsigned int v19; 
  _ETHREAD *CurrentThread; 
  unsigned int SessionId; 
  char v22; 
  int v23; 
  bool v24; 
  __int64 v25; 
  unsigned __int64 v26; 
  unsigned __int8 v27; 
  UINT8 v28; 
  unsigned int a3; 
  unsigned int v30[20]; 
  UINT8 v31; 
  unsigned int v32; 
  v32 = a4;
  v28 = -1;
  a3 = 0;
  v5 = a4;
  v31 = -1;
  v6 = r8_0;
  v9 = 0;
  if( (int)r8_0 < 0 )
  {
    v10 = 1;
    v6 = 1;
  }
  else
  {
    v10 = 0;
  }
  if( (RtlpHpLfhPerfFlags & 0x20) != 0 && !v10 )
  {
    v11 = *(_QWORD *)a1;
    if( (*(_BYTE *)(*(_QWORD *)a1 + 13i64) & 8) == 0 )
    {
      v12 = *(__int16 *)(v11 + 22);
      result = *(_QWORD *)(v12 + v11 + 8) >> *(_BYTE *)(v11 + 11);
      if( result <= 8 )
        result = 8i64;
      v14 = *(_QWORD *)(v12 + v11 + 8) >> *(_BYTE *)(v11 + 12);
      if( v14 <= 8 )
        v14 = 8i64;
      v15 = *(_QWORD *)(v12 + v11 + 16) + *(_QWORD *)(v12 + v11 + 24);
      if( v15 <= result || (result = RtlpHpScheduleCompaction(*(_QWORD **)(v11 + 56)), (result & 0x80000000) == 0i64) )
      {
        if( v15 <= v14 )
          return result;
      }
      v5 = v32;
    }
  }
  result = *(unsigned __int8 *)(a2 + 45);
  if( v6 < (unsigned int)result )
  {
    do
    {
      result = RtlpHpLfhSubsegmentFindEmptyUnits(a2, v6, &a3);
      v6 = result;
      if( (_DWORD)result == -1 )
        break;
      result = a3;
      if( a3 < v5 )
      {
        if( !v10 )
          break;
        v6 += a3;
      }
      else if( v9 )
      {
        v17 = *(_BYTE *)(a2 + 44);
        v18 = v6 << v17;
        v19 = a3 << v17;
        ((void(__fastcall *)(_QWORD, INT64, _QWORD))(a1 ^ RtlpHpHeapGlobals ^ *(_QWORD *)(a1 + 32)))(
          *(_QWORD *)a1,
          a2 + (v6 << v17),
          a3 << v17);
        result = RtlpHpLfhSubsegmentDecBlockCounts(a1, a2, v18, v19);
        if( !v10 )
          break;
        v6 += a3;
        v5 = v32;
      }
      else
      {
        if( (a5 & 1) == 0 )
          v28 = RtlpHpAcquireLockShared((INT64 *)(a1 + 72), *(unsigned __int8 *)(a1 + 57));
        v9 = 2;
        v31 = RtlpHpAcquireLockExclusive((INT64 *)(a2 + 24), *(unsigned __int8 *)(a1 + 57));
      }
      result = *(unsigned __int8 *)(a2 + 45);
    }
    while( v6 < (unsigned int)result );
    if( v9 )
    {
      v16 = a2 + 24;
      if( *(_BYTE *)(a1 + 57) )
      {
        ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v16);
        result = v31;
        __writecr8(v31);
      }
      else
      {
        if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v16, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((volatile INT64 *)v16);
        v30[0] = 0;
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        if( (unsigned int)MiGetSystemRegionType(v16) == 1 )
          SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
        else
          SessionId = -1;
        --*((_WORD *)CurrentThread + 243);
        v22 = ++*((_BYTE *)CurrentThread + 794);
        v23 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
        v24 = !_BitScanReverse((unsigned int *)&v25, v23);
        if( v24 )
          goto LABEL_44;
        while( 1 )
        {
          v26 = *((_QWORD *)CurrentThread + 100) + 96 * v25;
          v23 &= ~(1 << v25);
          if( (*(_BYTE *)(v26 + 26) & 1) != 0
            && (*(_DWORD *)(v26 + 32) & 1) == 0
            && (*(_QWORD *)(v26 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v16 & 0x7FFFFFFFFFFFFFFCi64)
            && *(_DWORD *)(v26 + 40) == SessionId )
          {
            *(_BYTE *)(v26 + 26) &= ~1u;
            if( *(_QWORD *)(v26 + 32) )
              break;
          }
          v24 = !_BitScanReverse((unsigned int *)&v25, v23);
          if( v24 )
            goto LABEL_44;
        }
        if( !v26 )
        {
LABEL_44:
          if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
            KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, v16, SessionId, 0i64);
        }
        else
        {
          *(_BYTE *)(v26 + 32) |= 2u;
          if( *(__int64 *)(v26 + 32) < 0 )
            KiAbEntryRemoveFromTree(v26);
          v30[0] = *(_DWORD *)(v26 + 88) & 0x1FFFF;
          *(_DWORD *)(v26 + 88) &= 0xFFFE0000;
          *(_BYTE *)(v26 + 25) &= ~1u;
          *(_QWORD *)(v26 + 32) = 0i64;
          v27 = 1 << ((__int64)(v26 - *((_QWORD *)CurrentThread + 100)) / 96);
          if( v22 == 1 )
            *((_BYTE *)CurrentThread + 792) |= v27;
          else
            _InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, v27);
        }
        --*((_BYTE *)CurrentThread + 794);
        KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, v16, v30);
        v24 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
        if( v24 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
          KiCheckForKernelApcDelivery();
        result = KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
      }
      if( (a5 & 1) == 0 )
      {
        if( *(_BYTE *)(a1 + 57) )
        {
          ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)(a1 + 72));
          result = v28;
          __writecr8(v28);
        }
        else
        {
          if( _InterlockedCompareExchange64((volatile signed __int64 *)(a1 + 72), 0i64, 17i64) != 17 )
            ExfReleasePushLockShared((INT64 *)(a1 + 72));
          KeAbPostRelease((PVOID)(a1 + 72));
          return KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
        }
      }
    }
  }
  return result;
}

Referenced by: