ExpRemovePoolTrackerExpansion

VOID __stdcall ExpRemovePoolTrackerExpansion(UINT64 Key, UINT64 NumberOfBytes, POOL_TYPE PoolType){
  int v4; 
  char v5; 
  _MM_SESSION_SPACE *Session; 
  _DWORD *v7; 
  unsigned __int64 v8; 
  unsigned int v9; 
  __int64 v10; 
  int v11; 
  _QWORD *v12; 
  __int64 v13; 
  int v14; 
  char *v15; 
  unsigned __int64 v16; 
  volatile signed __int64 *v17; 
  _KLOCK_QUEUE_HANDLE LockHandle; 

  v4 = Key;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v5 = PoolType;
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&ExpTaggedPoolLock, &LockHandle);
  if( (v5 & 0x20) != 0 )
  {
    Session = KeGetCurrentThread()->ApcState.Process->Session;
    v7 = (_DWORD *)*((_QWORD *)Session + 122);
    v8 = *((_QWORD *)Session + 123);
  }
  else
  {
    v8 = PoolTrackTableExpansionSize;
    v7 = PoolTrackTableExpansion;
  }
  v9 = 0;
  if( v8 )
  {
    v10 = 0i64;
    while( 1 )
    {
      v11 = v7[14 * v10];
      if( v11 == v4 )
        break;
      if( v11 )
      {
        v10 = ++v9;
        if( v9 < v8 )
          continue;
      }
      goto LABEL_14;
    }
    v12 = &v7[14 * v9];
    if( (v5 & 1) != 0 )
    {
      ++v12[6];
      v12[4] -= NumberOfBytes;
    }
    else
    {
      ++v12[3];
      v12[1] -= NumberOfBytes;
    }
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
  }
  else
  {
LABEL_14:
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    v13 = (unsigned int)KiIrqlFlags;
    __writecr8(LockHandle.OldIrql);
    if( (v5 & 0x20) != 0 )
    {
      v15 = (char *)ExpSessionPoolTrackTable;
      v14 = ExpSessionPoolTrackTableSize;
    }
    else
    {
      LODWORD(v13) = KeGetPcr()->Prcb.Number;
      v14 = PoolTrackTableSize;
      v15 = (char *)*((_QWORD *)&WheapDeferredInternalLogsEventLock + v13 + 372);
    }
    v16 = -(__int64)NumberOfBytes;
    v17 = (volatile signed __int64 *)&v15[56 * (v14 - 1)];
    if( (v5 & 1) != 0 )
    {
      _InterlockedIncrement64(v17 + 6);
      _InterlockedExchangeAdd64(v17 + 4, v16);
    }
    else
    {
      _InterlockedIncrement64(v17 + 3);
      _InterlockedExchangeAdd64(v17 + 1, v16);
    }
  }
}

Referenced by: