RtlpHpLargeFree
UINT64 __stdcall RtlpHpLargeFree(VOID *HeapAddress, VOID *Address, CHAR a3){
VOID *v3;
UINT64 v4;
char *v6;
UINT8 v7;
UINT64 *v8;
unsigned __int64 v9;
UINT64 v10;
unsigned __int64 v11;
UINT64 v12;
int v13;
__m128i v14;
unsigned __int64 v15;
unsigned __int64 v16;
char v17;
__int64 v18;
_ETHREAD *CurrentThread;
unsigned int SessionId;
unsigned __int8 v22;
int v23;
bool v24;
__int64 v25;
_KLOCK_ENTRY *v26;
__int64 v27;
__m128i v28;
unsigned __int64 v29;
_ETHREAD *v30;
unsigned int v31;
unsigned __int8 v32;
int v33;
__int64 v34;
_KLOCK_ENTRY *v35;
__int64 v36;
UINT64 v37;
UINT64 a3a;
__int64 v39[2];
__m128i v40;
__m128i v41;
UINT64 v43;
int v44;
v43 = (UINT64)Address;
v3 = Address;
v4 = 0i64;
v39[0] = 0i64;
v6 = (char *)HeapAddress;
v7 = RtlpHpLargeLockAcquire((__int64)HeapAddress, a3);
v8 = (UINT64 *)(v6 + 72);
v9 = v7;
v10 = *((_QWORD *)v6 + 9);
if( (v6[80] & 1) != 0 )
{
if( v10 )
v10 ^= (unsigned __int64)v8;
else
v10 = 0i64;
}
while( v10 )
{
v11 = *(_QWORD *)(v10 + 24) & 0xFFFFFFFFFFFF0000ui64;
if( (unsigned __int64)v3 >= v11 )
{
if( (unsigned __int64)v3 <= v11 )
goto LABEL_16;
v12 = *(_QWORD *)(v10 + 8);
}
else
{
v12 = *(_QWORD *)v10;
}
if( (v6[80] & 1) != 0 && v12 )
v10 ^= v12;
else
v10 = v12;
}
v10 = 0i64;
LABEL_16:
v13 = a3 & 1;
if( v10 )
{
RtlRbRemoveNode(v8, v10);
if( !v13 )
{
v14 = *(__m128i *)v6;
v15 = (unsigned __int64)(v6 + 64);
if( (_mm_cvtsi128_si32(v14) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v15);
__writecr8(v9);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v15, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v15);
LODWORD(a3a) = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v15) == 1 )
SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
else
SessionId = -1;
--CurrentThread->Tcb.SpecialApcDisable;
v22 = ++CurrentThread->Tcb.AbAllocationRegionCount;
v23 = ((char)CurrentThread->Tcb.AbEntrySummary | (char)CurrentThread->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v24 = !_BitScanReverse((unsigned int *)&v25, v23);
HIDWORD(v37) = v25;
if( v24 )
break;
v26 = &CurrentThread->Tcb.LockEntries[v25];
v23 &= ~(1 << v25);
if( (v26->AcquiredByte & 1) != 0
&& (v26->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v26->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v15 & 0x7FFFFFFFFFFFFFFCi64)
&& v26->LockState.SessionId == SessionId )
{
v26->AcquiredByte &= ~1u;
if( v26->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v26 )
{
v26->CrossThreadReleasableAndBusyByte |= 2u;
if( v26->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v26);
LODWORD(a3a) = v26->BoostBitmap.AllFields & 0x1FFFF;
v26->BoostBitmap.AllFields &= 0xFFFE0000;
v26->ThreadLocalFlags &= ~1u;
v26->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v27 = v26 - CurrentThread->Tcb.LockEntries;
if( v22 == 1 )
CurrentThread->Tcb.AbEntrySummary |= 1 << v27;
else
_InterlockedOr8((volatile signed __int8 *)&CurrentThread->Tcb.AbOrphanedEntrySummary, 1 << v27);
goto LABEL_40;
}
break;
}
}
}
if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, CurrentThread, (PVOID)v15, (PVOID)SessionId, 0i64);
LABEL_40:
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)v15, &a3a);
v24 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v24
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
v6 = (char *)HeapAddress;
}
v16 = *(_QWORD *)(v10 + 32);
v17 = (unsigned __int8)v16 >> 2;
v40 = *(__m128i *)v6;
v18 = (((v16 >> 12) + ((v16 >> 1) & 1)) << 12) - 1;
v39[0] = (1i64 << v17) - (((1i64 << v17) - 1) & ((1i64 << v17) + v18)) + v18;
RtlpHpFreeVA(&v43, (UINT64 *)v39, 0x8000i64, (__int128 *)v40.m128i_i8);
_InterlockedExchangeAdd64((volatile signed __int64 *)v6 + 12, -(*(_QWORD *)(v10 + 32) >> 12));
_InterlockedExchangeAdd64((volatile signed __int64 *)v6 + 11, -((unsigned __int64)v39[0] >> 12));
v41 = *(__m128i *)v6;
RtlpHpMetadataFree(v10, &v41);
return v39[0];
}
else
{
if( !v13 )
{
v28 = *(__m128i *)v6;
v29 = (unsigned __int64)(v6 + 64);
if( (_mm_cvtsi128_si32(v28) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v29);
__writecr8(v9);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v29, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v29);
LODWORD(v37) = 0;
v30 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v29) == 1 )
v31 = MmGetSessionIdEx(v30->Tcb.ApcState.Process);
else
v31 = -1;
--v30->Tcb.SpecialApcDisable;
v32 = ++v30->Tcb.AbAllocationRegionCount;
v33 = ((char)v30->Tcb.AbEntrySummary | (char)v30->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v24 = !_BitScanReverse((unsigned int *)&v34, v33);
v44 = v34;
if( v24 )
goto LABEL_56;
v35 = &v30->Tcb.LockEntries[v34];
v33 &= ~(1 << v34);
if( (v35->AcquiredByte & 1) != 0
&& (v35->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v35->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v29 & 0x7FFFFFFFFFFFFFFCi64)
&& v35->LockState.SessionId == v31 )
{
v35->AcquiredByte &= ~1u;
if( v35->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
}
if( !v35 )
{
LABEL_56:
if( (*(&v30->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v30, (PVOID)v29, (PVOID)v31, 0i64);
goto LABEL_68;
}
v35->CrossThreadReleasableAndBusyByte |= 2u;
if( v35->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v35);
LODWORD(v37) = v35->BoostBitmap.AllFields & 0x1FFFF;
v35->BoostBitmap.AllFields &= 0xFFFE0000;
v35->ThreadLocalFlags &= ~1u;
v35->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v36 = v35 - v30->Tcb.LockEntries;
if( v32 == 1 )
v30->Tcb.AbEntrySummary |= 1 << v36;
else
_InterlockedOr8((volatile signed __int8 *)&v30->Tcb.AbOrphanedEntrySummary, 1 << v36);
LABEL_68:
--v30->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v30->Tcb, (VOID *)v29, &v37);
v24 = v30->Tcb.SpecialApcDisable++ == -1;
if( v24 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v30->Tcb.ApcState.ApcListHead[0].Flink != &v30->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
v3 = (VOID *)v43;
}
v6 = (char *)HeapAddress;
}
RtlpLogHeapFailure(heap_failure_block_not_busy, v6, v3, 0i64, 0i64);
}
return v4;
}Referenced by:
ExFreeHeapPool
RtlpHpFreeHeap