ExpFreeHeapSpecialPool

NTSTATUS __stdcall ExpFreeHeapSpecialPool(PVOID HeapAddress, UINT64 BugCheckParameter1){
  NTSTATUS v4; 
  __int16 v5; 
  POOL_TYPE v6; 
  UINT64 v7; 
  int v8; 
  unsigned __int8 CurrentIrql; 
  _DWORD *v10; 
  UINT64 v11; 
  _BYTE *i; 
  __int64 v13; 
  __int64 v14; 
  int v15; 
  char *v16; 
  unsigned int v17; 
  __int64 v18; 
  char *v19; 
  int v20; 
  int v21; 

  v4 = MiDeterminePoolType(BugCheckParameter1);
  v6 = NonPagedPool;
  if( v4 != 32 )
    v6 = v4;
  v7 = 4096 - (v5 & 0xFFFu);
  ExpFreePoolChecks((VOID *)BugCheckParameter1, v7, NonPagedPool);
  v8 = v6 & 1;
  CurrentIrql = KeGetCurrentIrql();
  if( CurrentIrql > (unsigned __int8)(2 - (v8 != 0)) )
    KeBugCheckEx(0xC1u, (PVOID)CurrentIrql, (PVOID)1, (PVOID)BugCheckParameter1, (PVOID)0x31);
  v10 = (_DWORD *)(BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64);
  v11 = *(_WORD *)(BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) & 0x1FFF;
  if( ((v11 + 15) & 0xFFFFFFFFFFFFFFF0ui64) != v7 )
    KeBugCheckEx(
      0xC1u,
      (PVOID)BugCheckParameter1,
      (PVOID)(*(_WORD *)(BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) & 0x1FFF),
      (PVOID)v7,
      (PVOID)0x21);
  for( i = (char *)v10 + ((*v10 & 0x4000) != 0 ? 24i64 : 16i64); (unsigned __int64)i < BugCheckParameter1; ++i )
  {
    if( *i != *(_BYTE *)((BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) + 2) )
      KeBugCheckEx(0xC1u, (PVOID)BugCheckParameter1, i, (PVOID)(unsigned int)*v10, (PVOID)0x23);
  }
  if( (*v10 & 0x4000) != 0 )
    VerifierFreeTrackedPool(
      (VOID *)BugCheckParameter1,
      *(_WORD *)(BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) & 0x1FFF,
      (unsigned int)v6,
      1ui64);
  v13 = *(unsigned int *)((BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) + 4);
  if( (_DWORD)v13 == PoolHitTag )
    __debugbreak();
  v14 = (unsigned int)*(&PerfGlobalGroupMask + 1);
  if( (v6 & 0x20) != 0 )
  {
    v16 = (char *)ExpSessionPoolTrackTable;
    v15 = ExpSessionPoolTrackTableMask;
  }
  else
  {
    LODWORD(v14) = KeGetPcr()->Prcb.Number;
    v15 = PoolTrackTableMask;
    v16 = (char *)*((_QWORD *)&WheapDeferredInternalLogsEventLock + v14 + 372);
  }
  v17 = v15 & ((40543 * v13) ^ ((unsigned __int64)(40543 * v13) >> 32));
  while( 1 )
  {
    v18 = 56i64 * v17;
    v19 = &v16[v18];
    v20 = *(_DWORD *)&v16[v18];
    if( v20 == (_DWORD)v13 )
      break;
    if( v20 || (v6 & 0x20) != 0 || (v21 = *(_DWORD *)(v18 + *(&WheapDeferredInternalLogsEventLock + 371))) == 0 )
    {
      v17 = v15 & (v17 + 1);
      if( v17 == (v15 & ((40543 * (int)v13) ^ ((unsigned __int64)(40543 * v13) >> 32))) )
      {
        ExpRemovePoolTrackerExpansion((unsigned int)v13, v11, v6);
        return RtlpHpFreeHeap(HeapAddress, v10, 0i64);
      }
    }
    else
    {
      *(_DWORD *)v19 = v21;
    }
  }
  _InterlockedIncrement64((volatile signed __int64 *)&v19[(v8 != 0 ? 0x18 : 0) + 24]);
  _InterlockedExchangeAdd64((volatile signed __int64 *)&v19[(v8 != 0 ? 0x18 : 0) + 8], -(__int64)v11);
  return RtlpHpFreeHeap(HeapAddress, v10, 0i64);
}

Referenced by: