MiAllocateFromSubAllocatedRegion

INT64 __fastcall MiAllocateFromSubAllocatedRegion(UINT64 a1, UINT64 a2, _QWORD *a3){
  __int64 v3; 
  UINT64 v4; 
  __int64 v5; 
  void *v6; 
  _ETHREAD *CurrentThread; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  __int64 *v12; 
  UINT64 ClearBitsAndSet; 
  UINT64 v14; 
  int v15; 
  unsigned int v16; 
  _MMVAD_SHORT *v17; 
  int NewSubAllocatedRegion; 
  __int64 *v20; 
  __int64 **v21; 
  UINT64 *ChangeProtection; 
  __int64 v23; 
  __int64 v24; 
  unsigned int v25; 
  v25 = a1;
  v3 = (int)a1;
  v4 = (a2 + 4095) >> 12;
  v5 = 0i64;
  v6 = 0i64;
  *a3 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v8 = *((_QWORD *)CurrentThread + 23);
  v9 = *(_QWORD *)(v8 + 1680) + 48i64;
  --*((_WORD *)CurrentThread + 243);
  v24 = v9;
  LOCK_ADDRESS_SPACE((__int64)CurrentThread, v8);
  if( (*(_DWORD *)(v8 + 1124) & 0x20) != 0 )
  {
    NewSubAllocatedRegion = -1073741558;
LABEL_16:
    UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, v8);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    return(unsigned int)NewSubAllocatedRegion;
  }
  v10 = 2 * (v3 + 17);
  v11 = v9 + 16 * (v3 + 17);
  v23 = v11;
  while( 2 )
  {
    LOCK_PAGE_TABLE_COMMITMENT(CurrentThread, (_EPROCESS *)v8);
    v12 = *(__int64 **)(v9 + 8 * v10);
    while( v12 != (__int64 *)v11 )
    {
      ClearBitsAndSet = RtlFindClearBitsAndSetEx(
                          (UINT64 *)v12 - 2,
                          v4,
                          (unsigned __int64)*((unsigned int *)v12 + 8) >> 2);
      v14 = ClearBitsAndSet;
      if( ClearBitsAndSet != -1i64 )
      {
        *((_DWORD *)v12 + 6) += v4;
        v15 = v12[4] & 3 | (4 * (v4 + ClearBitsAndSet));
        v16 = *((_DWORD *)v12 + 6);
        *((_DWORD *)v12 + 8) = v15;
        if( v16 >= *((_DWORD *)v12 + 7) )
        {
          v20 = (__int64 *)*v12;
          if( *(__int64 **)(*v12 + 8) != v12 || (v21 = (__int64 **)v12[1], *v21 != v12) )
            __fastfail(3u);
          *v21 = v20;
          v20[1] = (__int64)v21;
          *v12 = 0i64;
        }
        v5 = v12[2];
        v11 = v23;
        v6 = (void *)((v14 << 12)
                    + ((*(unsigned int *)(v5 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v5 + 32) << 32)) << 12));
        break;
      }
      v12 = (__int64 *)*v12;
      v11 = v23;
    }
    UNLOCK_PAGE_TABLE_COMMITMENT((__int64)CurrentThread, v8);
    if( !v5 )
    {
      NewSubAllocatedRegion = MiAllocateNewSubAllocatedRegion(v25, v4);
      if( NewSubAllocatedRegion >= 0 )
      {
        v9 = v24;
        continue;
      }
      goto LABEL_16;
    }
    break;
  }
  MiReferenceVad(v5);
  UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, v8);
  MiLockVad((__int64)CurrentThread, v5);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( !(unsigned int)MiVadDeleted(v5) )
  {
    LODWORD(ChangeProtection) = 0;
    NewSubAllocatedRegion = MiCommitExistingVad(v17, v6, a2, (*(_DWORD *)(v5 + 48) >> 7) & 0x1F, ChangeProtection);
    if( NewSubAllocatedRegion < 0 )
    {
      MiFreeToSubAllocatedRegion((PVOID)v5);
    }
    else
    {
      MiUnlockAndDereferenceVad((PVOID)v5);
      *a3 = v6;
    }
    return(unsigned int)NewSubAllocatedRegion;
  }
  MiUnlockAndDereferenceVad(v17);
  return 3221225738i64;
}

Referenced by: