RtlpHpLfhBucketUpdateAffinityMapping
VOID __stdcall RtlpHpLfhBucketUpdateAffinityMapping(PLIST_ENTRY ListHead){
INT64 v1;
INT64 v3;
char CurrentProcessorNumber;
unsigned int Blink_low;
__int64 v6;
unsigned int SessionId;
__int64 v8;
_ETHREAD *CurrentThread;
__int64 v10;
__int64 v11;
volatile signed __int64 *v12;
UINT8 v13;
unsigned __int8 *v14;
unsigned __int64 v15;
unsigned __int8 *v16;
unsigned int v17;
__int64 v18;
__int64 v19;
__int64 v20;
unsigned int v21;
char *v22;
unsigned __int8 v23;
_ETHREAD *v24;
unsigned __int8 v25;
int v26;
bool v27;
__int64 v28;
_KLOCK_ENTRY *v29;
__int64 v30;
_ETHREAD *v31;
int v32;
__int64 v33;
_KLOCK_ENTRY *v34;
unsigned __int8 v35;
__int64 v36;
__int64 v37;
__int64 v38;
int v39[8];
unsigned __int8 v40;
int v41;
UINT64 v42;
UINT64 a3;
__int64 v44;
UINT64 v45;
__int64 v46;
char v47[64];
v45 = (UINT64)ListHead;
v3 = v1;
CurrentProcessorNumber = KeGetCurrentProcessorNumberEx(0i64);
Blink_low = LOBYTE(ListHead[3].Blink);
v6 = CurrentProcessorNumber & 0x3F;
SessionId = -1;
if( (unsigned int)v6 >= Blink_low )
{
if( (_DWORD)v6 == Blink_low || (_BYTE)Blink_low == 1 )
v6 = 0i64;
else
v6 = *((unsigned __int8 *)&ListHead[3].Flink->Flink + -1 - Blink_low + (unsigned int)v6);
}
v8 = *(_QWORD *)(v3 + 88);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v10 = (unsigned int)v6;
v46 = (unsigned int)v6;
v11 = *(unsigned __int8 *)(v6 + v8);
if( BYTE1(CurrentThread->HeapData) != (_DWORD)v6 )
{
BYTE1(CurrentThread->HeapData) = v6;
return;
}
memset(v47, 0i64, sizeof(v47));
v12 = (volatile signed __int64 *)(v3 + 80);
v13 = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)(v3 + 80), BYTE1(ListHead[3].Blink));
v14 = *(unsigned __int8 **)(v3 + 88);
v15 = v13;
v16 = &v14[v10];
if( (_BYTE)v11 != v14[v10] )
goto LABEL_16;
v17 = LOBYTE(ListHead[3].Blink);
if( (_BYTE)v17 )
{
v18 = LOBYTE(ListHead[3].Blink);
do
{
v19 = *v14++;
++v47[v19];
--v18;
}
while( v18 );
}
if( v47[v11] == 1 )
goto LABEL_16;
v20 = (unsigned int)(v11 + 1);
v21 = v20;
if( (unsigned int)v20 < v17 )
{
v22 = &v47[(unsigned int)v20];
do
{
if( !*v22 )
break;
if( (unsigned __int8)*v22 < (unsigned __int8)v47[v20] )
v20 = v21;
++v21;
++v22;
}
while( v21 < v17 );
}
if( v47[v20] )
{
*v16 = v20;
LABEL_16:
if( BYTE1(ListHead[3].Blink) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v3 + 80));
__writecr8(v15);
}
else
{
if( (_InterlockedExchangeAdd64(v12, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v3 + 80));
LODWORD(a3) = 0;
v24 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v3 + 80) == 1 )
SessionId = MmGetSessionIdEx(v24->Tcb.ApcState.Process);
--v24->Tcb.SpecialApcDisable;
v25 = ++v24->Tcb.AbAllocationRegionCount;
v26 = ((char)v24->Tcb.AbEntrySummary | (char)v24->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v27 = !_BitScanReverse((unsigned int *)&v28, v26);
HIDWORD(v42) = v28;
if( v27 )
break;
v29 = &v24->Tcb.LockEntries[v28];
v26 &= ~(1 << v28);
if( (v29->AcquiredByte & 1) != 0
&& (v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)v12 & 0x7FFFFFFFFFFFFFFCi64)
&& v29->LockState.SessionId == SessionId )
{
v29->AcquiredByte &= ~1u;
if( v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v29 )
{
v29->CrossThreadReleasableAndBusyByte |= 2u;
if( v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v29);
LODWORD(a3) = v29->BoostBitmap.AllFields & 0x1FFFF;
v29->BoostBitmap.AllFields &= 0xFFFE0000;
v29->ThreadLocalFlags &= ~1u;
v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v30 = v29 - v24->Tcb.LockEntries;
if( v25 == 1 )
v24->Tcb.AbEntrySummary |= 1 << v30;
else
_InterlockedOr8((volatile signed __int8 *)&v24->Tcb.AbOrphanedEntrySummary, 1 << v30);
goto LABEL_33;
}
break;
}
}
}
if( (*(&v24->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v24, (PVOID)v12, (PVOID)SessionId, 0i64);
LABEL_33:
--v24->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v24->Tcb, (VOID *)v12, &a3);
v27 = v24->Tcb.SpecialApcDisable++ == -1;
if( v27 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v24->Tcb.ApcState.ApcListHead[0].Flink != &v24->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
return;
}
v23 = *(_BYTE *)(v3 + 77);
if( v23 < 0x1Eu )
{
*(_BYTE *)(v3 + 77) = v23 + 1;
goto LABEL_16;
}
if( BYTE1(ListHead[3].Blink) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v3 + 80));
__writecr8(v15);
}
else
{
if( (_InterlockedExchangeAdd64(v12, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v3 + 80));
LODWORD(v42) = 0;
v31 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v3 + 80) == 1 )
SessionId = MmGetSessionIdEx(v31->Tcb.ApcState.Process);
--v31->Tcb.SpecialApcDisable;
v40 = ++v31->Tcb.AbAllocationRegionCount;
v32 = ((char)v31->Tcb.AbEntrySummary | (char)v31->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v27 = !_BitScanReverse((unsigned int *)&v33, v32);
v41 = v33;
if( v27 )
break;
v34 = &v31->Tcb.LockEntries[v33];
v32 &= ~(1 << v33);
if( (v34->AcquiredByte & 1) != 0
&& (v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)v12 & 0x7FFFFFFFFFFFFFFCi64)
&& v34->LockState.SessionId == SessionId )
{
v34->AcquiredByte &= ~1u;
if( v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
{
if( v34 )
{
v34->CrossThreadReleasableAndBusyByte |= 2u;
if( v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v34);
LODWORD(v42) = v34->BoostBitmap.AllFields & 0x1FFFF;
v34->BoostBitmap.AllFields &= 0xFFFE0000;
v34->ThreadLocalFlags &= ~1u;
v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v35 = 1 << ((char)((_BYTE)v34 - LOBYTE(v31->Tcb.LockEntries)) / 96);
if( v40 == 1 )
v31->Tcb.AbEntrySummary |= v35;
else
_InterlockedOr8((volatile signed __int8 *)&v31->Tcb.AbOrphanedEntrySummary, v35);
goto LABEL_61;
}
break;
}
}
}
if( (*(&v31->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v31, (PVOID)(v3 + 80), (PVOID)SessionId, 0i64);
LABEL_61:
--v31->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v31->Tcb, (VOID *)(v3 + 80), &v42);
v27 = v31->Tcb.SpecialApcDisable++ == -1;
if( v27 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v31->Tcb.ApcState.ApcListHead[0].Flink != &v31->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
v44 = 0i64;
v36 = *(_QWORD *)(v3 + 96);
LOWORD(v44) = 2;
if( !_InterlockedCompareExchange64((volatile signed __int64 *)(v36 + 8 * v20), 2i64, 0i64) )
{
LODWORD(v37) = RtlpHpLfhBucketAllocateSlot(v45, v3, (unsigned int)v20);
*(_QWORD *)(*(_QWORD *)(v3 + 96) + 8 * v20) = v37;
if( v37 )
{
_InterlockedOr(v39, 0);
v38 = v46;
*(_BYTE *)(v3 + 2) = v20 + 1;
*(_BYTE *)(v38 + *(_QWORD *)(v3 + 88)) = v20;
*(_BYTE *)(v3 + 77) = 0;
}
}
}Referenced by:
RtlpHpLfhSlotAllocate