PspStorageEmptyArrayNonReadonly

INT64 __fastcall PspStorageEmptyArrayNonReadonly(INT64 a1, UINT64 a2){
  unsigned int v2; 
  unsigned int v3; 
  INT64 v4; 
  __int64 v5; 
  void *v6; 
  char v7; 
  _ETHREAD *v8; 
  unsigned int v9; 
  char v10; 
  int v11; 
  bool v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  int v15; 
  unsigned int v16; 
  __int64 v17; 
  char v18; 
  _ETHREAD *CurrentThread; 
  unsigned int v20; 
  char v21; 
  int v22; 
  __int64 v23; 
  unsigned __int64 v24; 
  int v25; 
  unsigned int v26; 
  __int64 v27; 
  unsigned int v29[5]; 
  INT64 v30; 
  unsigned int v31; 
  int v32; 
  v31 = a2;
  v30 = a1;
  v2 = 0;
  v3 = 0;
  if( (_DWORD)a2 )
  {
    while( 1 )
    {
      v4 = a1 + 16i64 * v3;
      ExAcquirePushLockExclusiveEx(v4, 0i64);
      v5 = *(_QWORD *)(v4 + 8);
      if( (v5 & 1) != 0 )
      {
        v18 = _InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64);
        if( (v18 & 2) != 0 && (v18 & 4) == 0 )
          ExfTryToWakePushLock((volatile INT64 *)v4);
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        v32 = 0;
        v20 = (unsigned int)MiGetSystemRegionType(v4) == 1 ? MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23)) : -1;
        --*((_WORD *)CurrentThread + 243);
        v21 = ++*((_BYTE *)CurrentThread + 794);
        v22 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
        while( 1 )
        {
          v12 = !_BitScanReverse((unsigned int *)&v23, v22);
          if( v12 )
            break;
          v24 = *((_QWORD *)CurrentThread + 100) + 96 * v23;
          v22 &= ~(1 << v23);
          if( (*(_BYTE *)(v24 + 26) & 1) != 0
            && (*(_DWORD *)(v24 + 32) & 1) == 0
            && (*(_QWORD *)(v24 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
            && *(_DWORD *)(v24 + 40) == v20 )
          {
            *(_BYTE *)(v24 + 26) &= ~1u;
            if( *(_QWORD *)(v24 + 32) )
            {
              if( v24 )
              {
                *(_BYTE *)(v24 + 32) |= 2u;
                if( *(__int64 *)(v24 + 32) < 0 )
                  KiAbEntryRemoveFromTree(v24);
                v25 = *(_DWORD *)(v24 + 88) & 0x1FFFF;
                v26 = *(_DWORD *)(v24 + 88) & 0xFFFE0000;
                *(_BYTE *)(v24 + 25) &= ~1u;
                v32 = v25;
                *(_DWORD *)(v24 + 88) = v26;
                *(_QWORD *)(v24 + 32) = 0i64;
                v27 = (__int64)(v24 - *((_QWORD *)CurrentThread + 100)) / 96;
                if( v21 == 1 )
                  *((_BYTE *)CurrentThread + 792) |= 1 << v27;
                else
                  _InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, 1 << v27);
                goto LABEL_43;
              }
              break;
            }
          }
        }
        if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
          KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, v4, v20, 0i64);
LABEL_43:
        --*((_BYTE *)CurrentThread + 794);
        KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, v4, (unsigned int *)&v32);
        v12 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
        if( v12 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
          KiCheckForKernelApcDelivery();
      }
      else
      {
        *(_QWORD *)(v4 + 8) = 1i64;
        v6 = (void *)(v5 & 0xFFFFFFFFFFFFFFFEui64);
        v7 = _InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64);
        if( (v7 & 2) != 0 && (v7 & 4) == 0 )
          ExfTryToWakePushLock((volatile INT64 *)v4);
        v8 = (_ETHREAD *)KeGetCurrentThread();
        v29[0] = 0;
        v9 = (unsigned int)MiGetSystemRegionType(v4) == 1 ? MmGetSessionIdEx(*((_QWORD *)v8 + 23)) : -1;
        --*((_WORD *)v8 + 243);
        v10 = ++*((_BYTE *)v8 + 794);
        v11 = (*((char *)v8 + 792) | *((char *)v8 + 870)) ^ 0x3F;
        while( 1 )
        {
          v12 = !_BitScanReverse((unsigned int *)&v13, v11);
          if( v12 )
            break;
          v14 = *((_QWORD *)v8 + 100) + 96 * v13;
          v11 &= ~(1 << v13);
          if( (*(_BYTE *)(v14 + 26) & 1) != 0
            && (*(_DWORD *)(v14 + 32) & 1) == 0
            && (*(_QWORD *)(v14 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
            && *(_DWORD *)(v14 + 40) == v9 )
          {
            *(_BYTE *)(v14 + 26) &= ~1u;
            if( *(_QWORD *)(v14 + 32) )
            {
              if( v14 )
              {
                *(_BYTE *)(v14 + 32) |= 2u;
                if( *(__int64 *)(v14 + 32) < 0 )
                  KiAbEntryRemoveFromTree(v14);
                v15 = *(_DWORD *)(v14 + 88) & 0x1FFFF;
                v16 = *(_DWORD *)(v14 + 88) & 0xFFFE0000;
                *(_BYTE *)(v14 + 25) &= ~1u;
                v29[0] = v15;
                *(_DWORD *)(v14 + 88) = v16;
                *(_QWORD *)(v14 + 32) = 0i64;
                v17 = (__int64)(v14 - *((_QWORD *)v8 + 100)) / 96;
                if( v10 == 1 )
                  *((_BYTE *)v8 + 792) |= 1 << v17;
                else
                  _InterlockedOr8((volatile signed __int8 *)v8 + 870, 1 << v17);
                goto LABEL_18;
              }
              break;
            }
          }
        }
        if( (*((_DWORD *)v8 + 30) & 0x10000) == 0 )
          KeBugCheckEx(0x162u, (ULONG_PTR)v8, v4, v9, 0i64);
LABEL_18:
        --*((_BYTE *)v8 + 794);
        KiAbThreadRemoveBoosts((ULONG_PTR)v8, v4, v29);
        v12 = (*((_WORD *)v8 + 243))++ == 0xFFFF;
        if( v12 && *((_ETHREAD **)v8 + 19) != (_ETHREAD *)((char *)v8 + 152) )
          KiCheckForKernelApcDelivery();
        if( v6 )
        {
          ObfDereferenceObjectWithTag(v6, 0x746C6644ui64);
          ++v2;
        }
      }
      if( ++v3 >= v31 )
        break;
      a1 = v30;
    }
  }
  return v2;
}

Referenced by: