ExpAllocateAsid

UINT64 __stdcall ExpAllocateAsid(){
  _EPROCESS *Process; 
  unsigned int v1; 
  VOID **PoolWithTag; 
  VOID **v3; 
  unsigned int v4; 
  _EPROCESS **v5; 
  int v6; 
  _KLOCK_QUEUE_HANDLE LockHandle; 

  memset(&LockHandle, 0, sizeof(LockHandle));
  Process = KeGetCurrentThread()->ApcState.Process;
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&WheapDeferredInternalLogsEventLock + 291, &LockHandle);
  while( 1 )
  {
    v4 = *(&WheapDeferredInternalLogsEventLock + 577);
    if( *(&WheapDeferredInternalLogsEventLock + 577) != *(&WheapDeferredInternalLogsEventLock + 578) )
      break;
    if( *(&WheapDeferredInternalLogsEventLock + 577) == *(&WheapDeferredInternalLogsEventLock + 576) )
    {
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      return 0i64;
    }
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    v1 = v4 + 8;
    if( v4 + 8 > v4 )
    {
      if( v1 > *(&WheapDeferredInternalLogsEventLock + 576) )
        v1 = *(&WheapDeferredInternalLogsEventLock + 576);
    }
    else
    {
      v1 = *(&WheapDeferredInternalLogsEventLock + 576);
    }
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 16i64 * v1, 1933670469i64);
    if( !PoolWithTag )
      return 0i64;
    KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&WheapDeferredInternalLogsEventLock + 291, &LockHandle);
    v3 = PoolWithTag;
    if( v4 == *(&WheapDeferredInternalLogsEventLock + 577) )
    {
      v3 = (VOID **)*(&WheapDeferredInternalLogsEventLock + 290);
      if( *(&WheapDeferredInternalLogsEventLock + 290) )
        memmove(PoolWithTag, *(&WheapDeferredInternalLogsEventLock + 290), 16 * v4);
      memset(&PoolWithTag[2 * v4], 0i64, 16 * (v1 - v4));
      *(&WheapDeferredInternalLogsEventLock + 290) = PoolWithTag;
      *(&WheapDeferredInternalLogsEventLock + 577) = v1;
    }
    if( v3 )
    {
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      ExFreeHeapPool(v3);
      KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&WheapDeferredInternalLogsEventLock + 291, &LockHandle);
    }
  }
  v5 = (_EPROCESS **)*(&WheapDeferredInternalLogsEventLock + 290);
  v6 = 0;
  if( *(&WheapDeferredInternalLogsEventLock + 577) )
  {
    while( *v5 )
    {
      v5 += 2;
      if( (unsigned int)++v6 >= *(&WheapDeferredInternalLogsEventLock + 577) )
        goto LABEL_22;
    }
    v5[1] = (_EPROCESS *)1;
    *v5 = Process;
  }
LABEL_22:
  ++*(&WheapDeferredInternalLogsEventLock + 578);
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
  return(unsigned int)(v6 + 1);
}

Referenced by: