RtlpHpHeapExtendContext
INT64 __fastcall RtlpHpHeapExtendContext(UINT64 rcx0, INT64 rdx0){
UINT64 v2;
INT64 v3;
unsigned int v5;
INT64 v6;
UINT8 v8;
__int64 v9;
unsigned __int64 v10;
unsigned __int64 v11;
__int128 v12;
unsigned __int64 v13;
int v14;
bool v15;
int v16;
_ETHREAD *CurrentThread;
unsigned int v18;
char v19;
int v20;
bool v21;
__int64 v22;
unsigned __int64 v23;
int v24;
unsigned int v25;
__int64 v26;
unsigned int SessionId;
char v28;
int v29;
__int64 v30;
unsigned __int64 v31;
int v32;
unsigned int v33;
__int64 v34;
_ETHREAD *v35;
char v36;
int v37;
__int64 v38;
unsigned __int64 v39;
int v40;
unsigned int v41;
__int64 v42;
ULONG_PTR BugCheckParameter4;
unsigned int v44[2];
int v45;
size_t a2;
INT64 a1[3];
__int128 a4;
INT64 a6[10];
int v51;
int v52;
v2 = rcx0 + 224;
a2 = 0i64;
v3 = rdx0;
a1[0] = 0i64;
RtlpHpAcquireReleaseLockExclusive((PVOID)(rcx0 + 224));
v5 = -1;
while( 1 )
{
while( 1 )
{
while( 1 )
{
v6 = *(_QWORD *)(rcx0 + 232);
if( (unsigned __int64)(v6 + v3) > *(_QWORD *)(rcx0 + 240) )
break;
if( v6 == _InterlockedCompareExchange64((volatile signed __int64 *)(rcx0 + 232), v6 + v3, v6) )
return v6;
}
v8 = RtlpHpAcquireLockExclusive((INT64 *)v2, *(_DWORD *)rcx0 & 1);
v9 = *(_QWORD *)(rcx0 + 232);
v10 = *(_QWORD *)(rcx0 + 240);
v11 = v8;
if( v9 + v3 > v10 )
break;
if( (*(_DWORD *)rcx0 & 1) == 0 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v2);
v51 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(v2) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
else
SessionId = -1;
--*((_WORD *)CurrentThread + 243);
v28 = ++*((_BYTE *)CurrentThread + 794);
v29 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
v21 = !_BitScanReverse((unsigned int *)&v30, v29);
if( v21 )
goto LABEL_54;
while( 1 )
{
v31 = *((_QWORD *)CurrentThread + 100) + 96 * v30;
v29 &= ~(1 << v30);
if( (*(_BYTE *)(v31 + 26) & 1) != 0
&& (*(_DWORD *)(v31 + 32) & 1) == 0
&& (*(_QWORD *)(v31 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v2 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v31 + 40) == SessionId )
{
*(_BYTE *)(v31 + 26) &= ~1u;
if( *(_QWORD *)(v31 + 32) )
break;
}
v21 = !_BitScanReverse((unsigned int *)&v30, v29);
if( v21 )
goto LABEL_54;
}
if( !v31 )
{
LABEL_54:
if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, v2, SessionId, 0i64);
}
else
{
*(_BYTE *)(v31 + 32) |= 2u;
if( *(__int64 *)(v31 + 32) < 0 )
KiAbEntryRemoveFromTree(v31);
v32 = *(_DWORD *)(v31 + 88) & 0x1FFFF;
v33 = *(_DWORD *)(v31 + 88) & 0xFFFE0000;
*(_BYTE *)(v31 + 25) &= ~1u;
v51 = v32;
*(_DWORD *)(v31 + 88) = v33;
*(_QWORD *)(v31 + 32) = 0i64;
v34 = (__int64)(v31 - *((_QWORD *)CurrentThread + 100)) / 96;
if( v28 == 1 )
*((_BYTE *)CurrentThread + 792) |= 1 << v34;
else
_InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, 1 << v34);
}
--*((_BYTE *)CurrentThread + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, v2, (unsigned int *)&v51);
v21 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
if( !v21 )
goto LABEL_28;
LABEL_26:
if( *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
KiCheckForKernelApcDelivery();
LABEL_28:
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
goto LABEL_29;
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v2);
__writecr8(v11);
}
v12 = *(_OWORD *)rcx0;
a1[0] = *(_QWORD *)(rcx0 + 240);
v13 = (v9 - v10 + 4095 + v3) & 0xFFFFFFFFFFFFF000ui64;
a2 = v13;
if( (*(_BYTE *)(rcx0 + 30) & 1) != 0 )
{
a4 = v12;
v14 = RtlpHpMetadataCommit(rcx0, v10, v13, &a4, 1);
}
else
{
LODWORD(BugCheckParameter4) = 4;
*(_OWORD *)a6 = v12;
v14 = RtlpHpAllocVA(a1, &a2, 0i64, 4096i64, BugCheckParameter4, (INT64)a6);
v13 = a2;
}
v15 = v14 < 0;
v16 = *(_DWORD *)rcx0;
if( v15 )
break;
*(_QWORD *)(rcx0 + 240) += v13;
if( (v16 & 1) == 0 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v2);
v44[0] = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(v2) == 1 )
v18 = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
else
v18 = -1;
--*((_WORD *)CurrentThread + 243);
v19 = ++*((_BYTE *)CurrentThread + 794);
v20 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
v21 = !_BitScanReverse((unsigned int *)&v22, v20);
v52 = v22;
if( v21 )
goto LABEL_34;
while( 1 )
{
v23 = *((_QWORD *)CurrentThread + 100) + 96 * v22;
v20 &= ~(1 << v22);
if( (*(_BYTE *)(v23 + 26) & 1) != 0
&& (*(_DWORD *)(v23 + 32) & 1) == 0
&& (*(_QWORD *)(v23 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v2 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v23 + 40) == v18 )
{
*(_BYTE *)(v23 + 26) &= ~1u;
if( *(_QWORD *)(v23 + 32) )
break;
}
v21 = !_BitScanReverse((unsigned int *)&v22, v20);
v52 = v22;
if( v21 )
goto LABEL_34;
}
if( !v23 )
{
LABEL_34:
if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, v2, v18, 0i64);
}
else
{
*(_BYTE *)(v23 + 32) |= 2u;
if( *(__int64 *)(v23 + 32) < 0 )
KiAbEntryRemoveFromTree(v23);
v24 = *(_DWORD *)(v23 + 88) & 0x1FFFF;
v25 = *(_DWORD *)(v23 + 88) & 0xFFFE0000;
*(_BYTE *)(v23 + 25) &= ~1u;
v44[0] = v24;
*(_DWORD *)(v23 + 88) = v25;
*(_QWORD *)(v23 + 32) = 0i64;
v26 = (__int64)(v23 - *((_QWORD *)CurrentThread + 100)) / 96;
if( v19 == 1 )
*((_BYTE *)CurrentThread + 792) |= 1 << v26;
else
_InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, 1 << v26);
}
--*((_BYTE *)CurrentThread + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, v2, v44);
v21 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
if( !v21 )
goto LABEL_28;
goto LABEL_26;
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v2);
__writecr8(v11);
LABEL_29:
v3 = rdx0;
}
v6 = 0i64;
if( (v16 & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v2);
__writecr8(v11);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v2);
v45 = 0;
v35 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(v2) == 1 )
v5 = MmGetSessionIdEx(*((_QWORD *)v35 + 23));
--*((_WORD *)v35 + 243);
v36 = ++*((_BYTE *)v35 + 794);
v37 = (*((char *)v35 + 792) | *((char *)v35 + 870)) ^ 0x3F;
while( 1 )
{
v21 = !_BitScanReverse((unsigned int *)&v38, v37);
v44[1] = v38;
if( v21 )
break;
v39 = *((_QWORD *)v35 + 100) + 96 * v38;
v37 &= ~(1 << v38);
if( (*(_BYTE *)(v39 + 26) & 1) != 0
&& (*(_DWORD *)(v39 + 32) & 1) == 0
&& (*(_QWORD *)(v39 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v2 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v39 + 40) == v5 )
{
*(_BYTE *)(v39 + 26) &= ~1u;
if( *(_QWORD *)(v39 + 32) )
{
if( v39 )
{
*(_BYTE *)(v39 + 32) |= 2u;
if( *(__int64 *)(v39 + 32) < 0 )
KiAbEntryRemoveFromTree(v39);
v40 = *(_DWORD *)(v39 + 88) & 0x1FFFF;
v41 = *(_DWORD *)(v39 + 88) & 0xFFFE0000;
*(_BYTE *)(v39 + 25) &= ~1u;
v45 = v40;
*(_DWORD *)(v39 + 88) = v41;
*(_QWORD *)(v39 + 32) = 0i64;
v42 = (__int64)(v39 - *((_QWORD *)v35 + 100)) / 96;
if( v36 == 1 )
*((_BYTE *)v35 + 792) |= 1 << v42;
else
_InterlockedOr8((volatile signed __int8 *)v35 + 870, 1 << v42);
goto LABEL_79;
}
break;
}
}
}
if( (*((_DWORD *)v35 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v35, v2, v5, 0i64);
LABEL_79:
--*((_BYTE *)v35 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v35, v2, (unsigned int *)&v45);
v21 = (*((_WORD *)v35 + 243))++ == 0xFFFF;
if( v21 && *((_ETHREAD **)v35 + 19) != (_ETHREAD *)((char *)v35 + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
return v6;
}Referenced by:
RtlpHpSegLfhExtendContext