RtlpHpSegPageRangeCoalesce

INT64 __fastcall RtlpHpSegPageRangeCoalesce(INT64 a1, INT64 a2, CHAR a3, INT64 a4, CHAR *a5){
  int v5; 
  UINT64 v9; 
  INT64 v10; 
  unsigned int v11; 
  INT64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  __int64 v17; 
  unsigned __int64 v19; 
  CHAR v20; 
  char v21; 
  char v22; 
  __int64 v23; 
  _ETHREAD *CurrentThread; 
  ULONG_PTR SessionId; 
  char v26; 
  int v27; 
  bool v28; 
  __int64 v29; 
  unsigned __int64 v30; 
  __int64 v31; 
  ULONG_PTR BugCheckParameter4; 
  INT64 a6[9]; 
  int v34; 
  int v35; 
  v5 = a4;
  LODWORD(a6[0]) = 0;
  while( 1 )
  {
    v9 = 0i64;
    v10 = (a2 - (a2 & *(_QWORD *)a1)) >> 5;
    v11 = (unsigned __int16)~*(_WORD *)(a2 + 28);
    if( (unsigned int)v10 + (unsigned __int8)HIBYTE(*(_DWORD *)(a2 + 28)) < 0x100 )
    {
      v9 = a2 + 32i64 * (unsigned __int8)HIBYTE(*(_DWORD *)(a2 + 28));
      if( (*(_BYTE *)(v9 + 24) & 1) != 0 )
        v9 = 0i64;
    }
    if( (unsigned int)v10 > *(unsigned __int8 *)(a1 + 10) )
    {
      v12 = a2 - 32;
      if( (*(_BYTE *)(a2 - 8) & 2) == 0 )
        v12 += -32i64 * *(unsigned __int8 *)(v12 + 31);
      if( (*(_BYTE *)(v12 + 24) & 1) == 0 )
      {
        RtlpHpSegFreeRangeRemove(a1, v12);
        *(_BYTE *)(v12 + 31) += *(_BYTE *)(a2 + 31);
        v11 += (unsigned __int16)~*(_WORD *)(v12 + 28);
        *(_WORD *)(v12 + 28) = ~(_WORD)v11;
        *(_BYTE *)(a2 + 24) &= (*(_BYTE *)(a2 + 31) <= 1u) - 4;
        a2 = v12;
        *(_BYTE *)(32i64 * ((unsigned int)*(unsigned __int8 *)(v12 + 31) - 1) + v12 + 31) = *(_BYTE *)(v12 + 31) - 1;
      }
    }
    *(_BYTE *)(a2 + 24) |= 0x11u;
    if( v9 )
    {
      RtlpHpSegFreeRangeRemove(a1, v9);
      v21 = *(_BYTE *)(a2 + 31);
      if( v21 != 1 )
      {
        *(_BYTE *)(32i64 * ((unsigned int)*(unsigned __int8 *)(a2 + 31) - 1) + a2 + 24) &= ~1u;
        v21 = *(_BYTE *)(a2 + 31);
      }
      *(_BYTE *)(a2 + 31) = v21 + *(_BYTE *)(v9 + 31);
      v11 += (unsigned __int16)~*(_WORD *)(v9 + 28);
      *(_WORD *)(a2 + 28) = ~(_WORD)v11;
      *(_BYTE *)(v9 + 24) &= ~2u;
      v22 = *(_BYTE *)(a2 + 31) - 1;
      v23 = 32i64 * ((unsigned int)*(unsigned __int8 *)(a2 + 31) - 1);
      *(_BYTE *)(v23 + a2 + 24) |= 1u;
      *(_BYTE *)(v23 + a2 + 31) = v22;
    }
    if( !v11 )
      break;
    if( !v5 && (*(_BYTE *)(a1 + 13) & 8) == 0 )
    {
      v13 = *(__int16 *)(a1 + 22);
      v14 = *(_QWORD *)(v13 + a1 + 8) >> *(_BYTE *)(a1 + 11);
      if( v14 <= 8 )
        v14 = 8i64;
      v15 = *(_QWORD *)(v13 + a1 + 8) >> *(_BYTE *)(a1 + 12);
      if( v15 <= 8 )
        v15 = 8i64;
      v16 = v11 + *(_QWORD *)(v13 + a1 + 16) + *(_QWORD *)(v13 + a1 + 24);
      if( (v16 <= v14 || (int)RtlpHpScheduleCompaction(*(_QWORD **)(a1 + 56)) >= 0) && v16 <= v15 )
        break;
    }
    v19 = (unsigned __int8)*a5;
    if( (a3 & 1) == 0 )
    {
      if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
      {
        ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a1 + 64));
        __writecr8(v19);
      }
      else
      {
        if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 64), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((volatile INT64 *)(a1 + 64));
        v34 = 0;
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        if( (unsigned int)MiGetSystemRegionType(a1 + 64) == 1 )
          SessionId = (unsigned int)MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
        else
          SessionId = 0xFFFFFFFFi64;
        --*((_WORD *)CurrentThread + 243);
        v26 = ++*((_BYTE *)CurrentThread + 794);
        v27 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
        v28 = !_BitScanReverse((unsigned int *)&v29, v27);
        v35 = v29;
        if( v28 )
          goto LABEL_50;
        while( 1 )
        {
          v30 = *((_QWORD *)CurrentThread + 100) + 96 * v29;
          v27 &= ~(1 << v29);
          if( (*(_BYTE *)(v30 + 26) & 1) != 0
            && (*(_DWORD *)(v30 + 32) & 1) == 0
            && (*(_QWORD *)(v30 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((a1 + 64) & 0x7FFFFFFFFFFFFFFCi64)
            && *(_DWORD *)(v30 + 40) == (_DWORD)SessionId )
          {
            *(_BYTE *)(v30 + 26) &= ~1u;
            if( *(_QWORD *)(v30 + 32) )
              break;
          }
          v28 = !_BitScanReverse((unsigned int *)&v29, v27);
          v35 = v29;
          if( v28 )
            goto LABEL_50;
        }
        if( !v30 )
        {
LABEL_50:
          if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
            KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, a1 + 64, SessionId, 0i64);
        }
        else
        {
          *(_BYTE *)(v30 + 32) |= 2u;
          if( *(__int64 *)(v30 + 32) < 0 )
            KiAbEntryRemoveFromTree(v30);
          v34 = 0;
          v34 = *(_DWORD *)(v30 + 88) & 0x1FFFF;
          *(_DWORD *)(v30 + 88) &= 0xFFFE0000;
          *(_BYTE *)(v30 + 25) &= ~1u;
          *(_QWORD *)(v30 + 32) = 0i64;
          v31 = (__int64)(v30 - *((_QWORD *)CurrentThread + 100)) / 96;
          if( v26 == 1 )
            *((_BYTE *)CurrentThread + 792) |= 1 << v31;
          else
            _InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, 1 << v31);
        }
        --*((_BYTE *)CurrentThread + 794);
        KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, a1 + 64, (unsigned int *)&v34);
        v28 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
        if( v28 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
          KiCheckForKernelApcDelivery();
        KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
      }
    }
    LODWORD(BugCheckParameter4) = 0;
    RtlpHpSegPageRangeCommit(
      a1,
      a2,
      0i64,
      -(*(unsigned __int8 *)(a2 + 31) << *(_BYTE *)(a1 + 9)),
      BugCheckParameter4,
      (INT64)a6);
    v20 = RtlpHpSegLockAcquire(a1, a3);
    *a5 = v20;
    *(_BYTE *)(a2 + 24) &= ~0x10u;
  }
  v17 = 32i64 * ((unsigned int)*(unsigned __int8 *)(a2 + 31) - 1);
  *(_BYTE *)(v17 + a2 + 24) &= ~1u;
  *(_BYTE *)(a2 + 24) &= 0xEEu;
  return a2;
}

Referenced by: