RtlpHpLfhSlotAllocate
NTSTATUS __stdcall RtlpHpLfhSlotAllocate(UINT64 a1, INT64 a2, INT64 r8_0, UINT64 a4, UINT64 a5){
INT64 v5;
UINT64 v6;
int v7;
UINT64 v8;
unsigned int v9;
signed __int64 v10;
signed __int64 v11;
unsigned __int64 v12;
UINT64 v13;
INT64 v14;
unsigned __int64 v15;
__int64 v16;
unsigned int v17;
unsigned int v18;
unsigned int v19;
unsigned int v20;
unsigned int v21;
NTSTATUS v22;
unsigned __int16 v23;
unsigned int v24;
char v25;
__int64 v26;
__int64 v27;
__int64 v28;
int v29;
__int64 v30;
__int64 v31;
signed __int16 *v32;
signed __int16 *v33;
unsigned __int64 v34;
UINT8 v35;
signed __int16 v36;
signed __int16 v37;
int v38;
unsigned int v39;
UINT64 v40;
unsigned __int64 v41;
INT64 v42;
INT64 Subsegment;
INT64 v45;
unsigned __int16 v46;
INT64 v47;
unsigned __int16 v48;
unsigned __int16 v49;
unsigned __int16 v50;
unsigned __int16 v51;
unsigned int v52;
__int64 *v53;
_QWORD *v54;
__int64 **v55;
INT64 v56;
INT64 *v57;
INT64 *v58;
bool v59;
INT64 v60;
unsigned __int64 v61;
__int64 v62;
unsigned int v63;
unsigned int v64;
unsigned int v65;
unsigned int v66;
unsigned __int16 v67;
UINT64 v68;
NTSTATUS v69;
unsigned int v70;
char v71;
__int64 v72;
INT64 v73;
__int64 v74;
__int64 v75;
__int64 v76;
signed __int16 *v77;
signed __int16 *v78;
unsigned __int64 v79;
signed __int16 v80;
signed __int16 v81;
int v82;
int v83;
__int64 v84;
unsigned int v85;
UINT64 v86;
INT64 v87;
int v88;
UINT8 v89;
_ETHREAD *v90;
void *v91;
UINT8 v92;
_ETHREAD *v93;
__int64 v94;
unsigned __int8 v95;
int v96;
__int64 v97;
bool v98;
__int64 v99;
_KLOCK_ENTRY *v100;
__int64 v101;
unsigned __int8 v102;
char v103;
int(__fastcall *v104)(__int64, unsigned __int64, _QWORD, __int64);
int v105;
unsigned int v106;
unsigned int v107;
__int64 v108;
UINT64 v109;
int v110;
__int64 v111;
_KLOCK_ENTRY *v112;
unsigned __int8 v113;
UINT64 v114;
INT64 v115;
INT64 *v116;
UINT8 v117;
_ETHREAD *v118;
unsigned int v119;
_ETHREAD *CurrentThread;
unsigned int SessionId;
int v122;
char v123;
int(__fastcall *v124)(__int64, INT64, _QWORD, __int64);
unsigned int v125;
unsigned int v126;
__int64 v127;
unsigned int v128;
__int16 v129;
_ETHREAD *v130;
__int64 v131;
unsigned __int8 v132;
int v133;
__int64 v134;
_KLOCK_ENTRY *v135;
unsigned __int8 v136;
unsigned __int8 v137;
int v138;
__int64 v139;
_KLOCK_ENTRY *v140;
unsigned __int8 v141;
unsigned __int8 v142;
int v143;
__int64 v144;
_KLOCK_ENTRY *v145;
unsigned __int8 v146;
UINT8 v147;
__int64 v148;
UINT8 v149;
UINT64 v150;
_ETHREAD *v151;
unsigned int v152;
unsigned __int8 v153;
int v154;
__int64 v155;
_KLOCK_ENTRY *v156;
__int64 v157;
unsigned __int8 v158;
UINT64 v159;
_ETHREAD *v160;
__int64 v161;
unsigned __int8 v162;
int v163;
__int64 v164;
_KLOCK_ENTRY *v165;
__int64 v166;
_ETHREAD *v167;
unsigned int v168;
unsigned __int8 v169;
int v170;
__int64 v171;
_KLOCK_ENTRY *v172;
unsigned __int8 v173;
UINT8 v174;
unsigned __int8 v175;
unsigned __int8 v176;
unsigned __int8 v177;
int v178;
unsigned int v179;
UINT8 v180;
char v181[3];
int v182;
unsigned int v183;
UINT64 v184;
unsigned int v185;
unsigned int v186;
int v187;
UINT64 v188;
INT64 v189;
__int64 v190;
UINT64 a3;
int v192;
int v193;
UINT64 v194;
UINT64 v195;
UINT64 v196;
int v197;
UINT64 v198;
UINT64 v199;
int v200;
int v201;
int v202;
int v203;
UINT64 v204[2];
UINT64 v205[11];
unsigned int v209;
v209 = a4;
v5 = r8_0;
v6 = a1;
v174 = -1;
v7 = 0;
v182 = 0;
v187 = 0;
v8 = r8_0 + 16;
v189 = 0i64;
v9 = ((unsigned int)RtlpHpLfhPerfFlags >> 2) & 1;
while( 1 )
{
while( 1 )
{
if( v9 )
{
while( 1 )
{
_m_prefetchw((const void *)(v5 + 56));
v10 = *(_QWORD *)(v5 + 56);
if( (v10 & 0xFFF) != 0 )
{
while( 1 )
{
v11 = _InterlockedCompareExchange64((volatile signed __int64 *)(v5 + 56), v10 - 1, v10);
if( v10 == v11 )
break;
v187 = 1;
v10 = v11;
if( (v11 & 0xFFF) == 0 )
goto LABEL_38;
}
v12 = v10 & 0xFFFFFFFFFFFFF000ui64;
if( v12 )
break;
}
LABEL_38:
if( v7 == 2 )
goto LABEL_39;
v88 = *(unsigned __int8 *)(v6 + 57);
v7 = 2;
v182 = 2;
v89 = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)(v5 + 16), v88);
v6 = a1;
v174 = v89;
}
if( v7 )
{
if( *(_BYTE *)(v6 + 57) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v5 + 16));
__writecr8(v174);
v13 = 0i64;
v182 = 0;
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v5 + 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v5 + 16));
v203 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v5 + 16) == 1 )
SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
else
SessionId = -1;
--CurrentThread->Tcb.SpecialApcDisable;
v137 = ++CurrentThread->Tcb.AbAllocationRegionCount;
v138 = ((char)CurrentThread->Tcb.AbEntrySummary | (char)CurrentThread->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v98 = !_BitScanReverse((unsigned int *)&v139, v138);
v202 = v139;
if( v98 )
goto LABEL_222;
while( 1 )
{
v140 = &CurrentThread->Tcb.LockEntries[v139];
v138 &= ~(1 << v139);
if( (v140->AcquiredByte & 1) != 0
&& (v140->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v140->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((v5 + 16) & 0x7FFFFFFFFFFFFFFCi64)
&& v140->LockState.SessionId == SessionId )
{
v140->AcquiredByte &= ~1u;
if( v140->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v98 = !_BitScanReverse((unsigned int *)&v139, v138);
v202 = v139;
if( v98 )
goto LABEL_222;
}
if( !v140 )
{
LABEL_222:
if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, CurrentThread, (PVOID)(v5 + 16), (PVOID)SessionId, 0i64);
}
else
{
v140->CrossThreadReleasableAndBusyByte |= 2u;
if( v140->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v140);
v203 = v140->BoostBitmap.AllFields & 0x1FFFF;
v140->BoostBitmap.AllFields &= 0xFFFE0000;
v140->ThreadLocalFlags &= ~1u;
v140->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v141 = 1 << (v140 - CurrentThread->Tcb.LockEntries);
if( v137 == 1 )
CurrentThread->Tcb.AbEntrySummary |= v141;
else
_InterlockedOr8((volatile signed __int8 *)&CurrentThread->Tcb.AbOrphanedEntrySummary, v141);
}
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)(v5 + 16), (UINT64 *)&v203);
v98 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v98
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
v13 = 0i64;
v182 = 0;
}
}
else
{
v13 = 0i64;
}
v14 = 3i64;
v15 = 2 * (*(unsigned __int16 *)(v12 + 34) + (unsigned __int64)*(unsigned __int8 *)(v12 + 39));
v204[1] = v12 + 48;
v16 = *(unsigned __int8 *)(v5 + 1);
v204[0] = v15;
LODWORD(v184) = *((unsigned __int8 *)RtlpSearchWidth + v16);
v17 = (unsigned __int16)(WORD4(RtlpHpHeapGlobals) ^ *(_WORD *)(v12 + 40) ^ ((unsigned int)v12 >> 12));
v18 = (DWORD2(RtlpHpHeapGlobals) ^ *(_DWORD *)(v12 + 40) ^ ((unsigned int)v12 >> 12)) >> 16;
v19 = v18;
v20 = v18;
v185 = v17;
if( v209 >= v17 )
v14 = 1i64;
if( (*(_BYTE *)(a1 + 62) & 2) != 0 )
{
v21 = v185;
v20 = v18;
if( v209 >= v17 )
v20 = v18;
}
else
{
v13 = *((unsigned __int8 *)RtlpLowFragHeapRandomData + (unsigned __int16)RtlpLfhIncrementDataSlot());
v21 = v185;
if( v209 >= v185 )
v20 = v19;
}
v22 = RtlpLfhBlockBitmapAllocate(v204, *(unsigned __int16 *)(v12 + 36), v13, (unsigned int)v184, v14);
v23 = (unsigned int)v12 >> 12;
LODWORD(v188) = v22;
*(_WORD *)(v12 + 36) = v22;
v24 = v20 + v22 * v21;
if( *(_BYTE *)(v12 + 45) > 1u )
{
v25 = *(_BYTE *)(v12 + 44);
v26 = *(unsigned __int16 *)(v12 + 46);
v27 = 0i64;
v192 = 0;
v28 = v24 >> v25;
v29 = *(unsigned __int16 *)(v12 + 40) ^ (unsigned __int16)((unsigned int)v12 >> 12);
v180 = -1;
v175 = -1;
v186 = WORD4(RtlpHpHeapGlobals) ^ v29;
v30 = 2 * v28;
v31 = ((v24 + v186 - 1) >> v25) - (unsigned int)v28 + 1;
v32 = (signed __int16 *)(2 * v28 + v12 + v26);
_m_prefetchw(v32);
v33 = &v32[v31];
LODWORD(v184) = 0;
v190 = 0i64;
v183 = -1;
if( v32 < v33 )
{
v34 = (unsigned __int64)v33;
do
{
v35 = v175;
while( 1 )
{
v36 = *v32;
while( v36 > 0 )
{
v37 = v36;
v36 = _InterlockedCompareExchange16(v32, v36 + 1, v36);
if( v37 == v36 )
{
v38 = v184;
v39 = v183;
goto LABEL_21;
}
}
if( (_DWORD)v27 )
break;
HIDWORD(v199) = 1;
v92 = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)(v12 + 24), *(unsigned __int8 *)(a1 + 57));
v27 = HIDWORD(v199);
v35 = v92;
v175 = v92;
}
v39 = v183;
if( v36 )
{
v38 = v184 + 1;
LODWORD(v184) = v184 + 1;
v190 = v30 >> 1;
if( v183 == -1 )
{
v39 = v30 >> 1;
v183 = v39;
}
}
else
{
v38 = v184 - 1;
LODWORD(v184) = v184 - 1;
}
*v32 = v36 + 1;
LABEL_21:
++v32;
v30 += 2i64;
}
while( (unsigned __int64)v32 < v34 );
v5 = r8_0;
v21 = v185;
if( v38 )
{
v40 = a1;
if( (RtlpHpLfhPerfFlags & 0x20) != 0 )
_InterlockedExchangeAdd64(
(volatile signed __int64 *)(*(__int16 *)(a1 + 58) + a1 + 24),
(v38 << *(_BYTE *)(v12 + 44)) / 4096);
}
else
{
v40 = a1;
}
if( v39 == -1 )
{
if( (_DWORD)v27 )
{
if( *(_BYTE *)(v40 + 57) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v12 + 24));
__writecr8(v175);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v12 + 24), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v12 + 24));
LODWORD(v195) = 0;
v93 = (_ETHREAD *)KeGetCurrentThread();
v188 = (UINT64)v93;
if( MiGetSystemRegionType(v12 + 24) == 1 )
v94 = (unsigned int)MmGetSessionIdEx(v93->Tcb.ApcState.Process);
else
v94 = 0xFFFFFFFFi64;
--v93->Tcb.SpecialApcDisable;
v109 = (UINT64)v93;
v177 = ++v93->Tcb.AbAllocationRegionCount;
v110 = ((char)v93->Tcb.AbEntrySummary | (char)v93->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v98 = !_BitScanReverse((unsigned int *)&v111, v110);
HIDWORD(v194) = v111;
if( v98 )
goto LABEL_139;
while( 1 )
{
v112 = (_KLOCK_ENTRY *)(*(_QWORD *)(v109 + 800) + 96 * v111);
v110 &= ~(1 << v111);
if( (v112->AcquiredByte & 1) != 0
&& (v112->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v112->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((v12 + 24) & 0x7FFFFFFFFFFFFFFCi64)
&& v112->LockState.SessionId == (_DWORD)v94 )
{
v112->AcquiredByte &= ~1u;
if( v112->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v98 = !_BitScanReverse((unsigned int *)&v111, v110);
HIDWORD(v194) = v111;
if( v98 )
goto LABEL_139;
}
if( !v112 )
{
LABEL_139:
if( (*(_DWORD *)(v109 + 120) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (PVOID)v109, (PVOID)(v12 + 24), (PVOID)v94, 0i64);
}
else
{
v112->CrossThreadReleasableAndBusyByte |= 2u;
if( v112->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
{
KiAbEntryRemoveFromTree(v112);
v109 = v188;
}
LODWORD(v195) = v112->BoostBitmap.AllFields & 0x1FFFF;
v112->BoostBitmap.AllFields &= 0xFFFE0000;
v112->ThreadLocalFlags &= ~1u;
v112->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v113 = 1 << (((__int64)v112 - *(_QWORD *)(v109 + 800)) / 96);
if( v177 == 1 )
*(_BYTE *)(v109 + 792) |= v113;
else
_InterlockedOr8((volatile signed __int8 *)(v109 + 870), v113);
}
--*(_BYTE *)(v109 + 794);
KiAbThreadRemoveBoosts((_KTHREAD *)v109, (VOID *)(v12 + 24), &v195);
v114 = v188;
v98 = (*(_WORD *)(v188 + 486))++ == 0xFFFF;
if( v98 && *(_QWORD *)(v114 + 152) != v114 + 152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
}
v23 = (unsigned int)v12 >> 12;
}
else
{
v103 = *(_BYTE *)(v12 + 44);
v104 = (int(__fastcall *)(__int64, unsigned __int64, _QWORD, __int64))(v40 ^ RtlpHpHeapGlobals ^ *(_QWORD *)(v40 + 24));
v105 = v190 - v39;
v180 = v35;
v106 = v39 << v103;
v192 = v105 + 1;
v107 = (v105 + 1) << v103;
v108 = *(_QWORD *)v40;
v183 = v106;
if( v104(v108, v12 + v106, v107, v27) < 0 )
{
v150 = v24;
v42 = a1;
RtlpHpLfhSubsegmentDecBlockCounts(a1, v12, v150, v186);
if( *(_BYTE *)(a1 + 57) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v12 + 24));
__writecr8(v175);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v12 + 24), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v12 + 24));
LODWORD(v194) = 0;
v151 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v12 + 24) == 1 )
v152 = MmGetSessionIdEx(v151->Tcb.ApcState.Process);
else
v152 = -1;
--v151->Tcb.SpecialApcDisable;
v153 = ++v151->Tcb.AbAllocationRegionCount;
v154 = ((char)v151->Tcb.AbEntrySummary | (char)v151->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v98 = !_BitScanReverse((unsigned int *)&v155, v154);
v193 = v155;
if( v98 )
{
LABEL_313:
if( (*(&v151->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v151, (PVOID)(v12 + 24), (PVOID)v152, 0i64);
}
else
{
while( 1 )
{
v156 = &v151->Tcb.LockEntries[v155];
v154 &= ~(1 << v155);
if( (v156->AcquiredByte & 1) != 0
&& (v156->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v156->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((v12 + 24) & 0x7FFFFFFFFFFFFFFCi64)
&& v156->LockState.SessionId == v152 )
{
v156->AcquiredByte &= ~1u;
if( v156->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v98 = !_BitScanReverse((unsigned int *)&v155, v154);
v193 = v155;
if( v98 )
goto LABEL_312;
}
if( !v156 )
{
LABEL_312:
v42 = a1;
goto LABEL_313;
}
v156->CrossThreadReleasableAndBusyByte |= 2u;
if( v156->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v156);
LODWORD(v194) = v156->BoostBitmap.AllFields & 0x1FFFF;
v156->BoostBitmap.AllFields &= 0xFFFE0000;
v156->ThreadLocalFlags &= ~1u;
v156->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v157 = (unsigned __int128)(((char *)v156 - (char *)v151->Tcb.LockEntries)
* (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
v42 = a1;
v158 = 1 << ((v157 >> 4) + (v157 < 0));
if( v153 == 1 )
v151->Tcb.AbEntrySummary |= v158;
else
_InterlockedOr8((volatile signed __int8 *)&v151->Tcb.AbOrphanedEntrySummary, v158);
}
--v151->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v151->Tcb, (VOID *)(v12 + 24), &v194);
v98 = v151->Tcb.SpecialApcDisable++ == -1;
if( v98
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v151->Tcb.ApcState.ApcListHead[0].Flink != &v151->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
v41 = 0i64;
if( (_DWORD)v188 != -1 )
_InterlockedAnd64(
(volatile signed __int64 *)(v12 + 8 * ((unsigned __int64)(unsigned int)(2 * v188) >> 6) + 48),
~(3i64 << ((2 * v188) & 0x3F)));
LABEL_29:
if( !v41 )
RtlpHpLfhSubsegmentFreeBlock(v42, v12, 0i64, a5);
if( !v182 )
goto LABEL_32;
v159 = v5 + 16;
if( v182 == 2 )
{
if( !*(_BYTE *)(v42 + 57) )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v159, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v159);
LODWORD(v196) = 0;
v160 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v159) == 1 )
v161 = (unsigned int)MmGetSessionIdEx(v160->Tcb.ApcState.Process);
else
v161 = 0xFFFFFFFFi64;
--v160->Tcb.SpecialApcDisable;
v162 = ++v160->Tcb.AbAllocationRegionCount;
v163 = ((char)v160->Tcb.AbEntrySummary | (char)v160->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v98 = !_BitScanReverse((unsigned int *)&v164, v163);
HIDWORD(v195) = v164;
if( v98 )
goto LABEL_343;
while( 1 )
{
v165 = &v160->Tcb.LockEntries[v164];
v163 &= ~(1 << v164);
if( (v165->AcquiredByte & 1) != 0
&& (v165->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v165->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v159 & 0x7FFFFFFFFFFFFFFCi64)
&& v165->LockState.SessionId == (_DWORD)v161 )
{
v165->AcquiredByte &= ~1u;
if( v165->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v98 = !_BitScanReverse((unsigned int *)&v164, v163);
HIDWORD(v195) = v164;
if( v98 )
goto LABEL_343;
}
if( !v165 )
{
LABEL_343:
if( (*(&v160->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v160, (PVOID)v159, (PVOID)v161, 0i64);
}
else
{
v165->CrossThreadReleasableAndBusyByte |= 2u;
if( v165->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v165);
LODWORD(v196) = v165->BoostBitmap.AllFields & 0x1FFFF;
v165->BoostBitmap.AllFields &= 0xFFFE0000;
v165->ThreadLocalFlags &= ~1u;
v165->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v166 = v165 - v160->Tcb.LockEntries;
if( v162 == 1 )
v160->Tcb.AbEntrySummary |= 1 << v166;
else
_InterlockedOr8((volatile signed __int8 *)&v160->Tcb.AbOrphanedEntrySummary, 1 << v166);
}
--v160->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v160->Tcb, (VOID *)v159, &v196);
v98 = v160->Tcb.SpecialApcDisable++ == -1;
if( v98
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v160->Tcb.ApcState.ApcListHead[0].Flink != &v160->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
goto LABEL_341;
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v159);
}
else
{
if( !*(_BYTE *)(v42 + 57) )
{
if( _InterlockedCompareExchange64((volatile signed __int64 *)v159, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)v159);
KeAbPostRelease((VOID *)v159);
LABEL_341:
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
goto LABEL_32;
}
ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v159);
}
__writecr8(v174);
goto LABEL_32;
}
RtlpHpLfhSubsegmentIncBlockCounts(a1, v12, v183, v107, &v192, 1, &v180);
v23 = (unsigned int)v12 >> 12;
}
}
}
v41 = v12 + v24;
if( v209 < v21 )
{
v128 = v21 - v209;
if( v128 == 1 )
v129 = 0x8000;
else
v129 = v128 & 0x3FFF;
*(_WORD *)((WORD4(RtlpHpHeapGlobals) ^ *(unsigned __int16 *)(v12 + 40) ^ (unsigned __int64)v23) + v41 - 2) = v129;
}
v42 = a1;
goto LABEL_29;
}
if( !v7 )
{
v7 = 1;
v147 = RtlpHpAcquireLockShared((_EX_PUSH_LOCK *)v8, *(unsigned __int8 *)(v6 + 57));
v6 = a1;
v174 = v147;
}
LABEL_39:
if( *(_QWORD *)(v5 + 8) )
break;
if( v7 == 2 )
{
if( *(_BYTE *)(v6 + 57) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v8);
LABEL_157:
__writecr8(v174);
goto LABEL_158;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v8);
HIDWORD(a3) = 0;
v118 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v5 + 16) == 1 )
v119 = MmGetSessionIdEx(v118->Tcb.ApcState.Process);
else
v119 = -1;
--v118->Tcb.SpecialApcDisable;
v132 = ++v118->Tcb.AbAllocationRegionCount;
v133 = ((char)v118->Tcb.AbEntrySummary | (char)v118->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v98 = !_BitScanReverse((unsigned int *)&v134, v133);
v201 = v134;
if( v98 )
goto LABEL_210;
while( 1 )
{
v135 = &v118->Tcb.LockEntries[v134];
v133 &= ~(1 << v134);
if( (v135->AcquiredByte & 1) != 0
&& (v135->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v135->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((v5 + 16) & 0x7FFFFFFFFFFFFFFCi64)
&& v135->LockState.SessionId == v119 )
{
v135->AcquiredByte &= ~1u;
if( v135->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v98 = !_BitScanReverse((unsigned int *)&v134, v133);
v201 = v134;
if( v98 )
goto LABEL_210;
}
if( !v135 )
{
LABEL_210:
if( (*(&v118->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v118, (PVOID)(v5 + 16), (PVOID)v119, 0i64);
}
else
{
v135->CrossThreadReleasableAndBusyByte |= 2u;
if( v135->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v135);
HIDWORD(a3) = 0;
HIDWORD(a3) = v135->BoostBitmap.AllFields & 0x1FFFF;
v135->BoostBitmap.AllFields &= 0xFFFE0000;
v135->ThreadLocalFlags &= ~1u;
v135->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v136 = 1 << (v135 - v118->Tcb.LockEntries);
if( v132 == 1 )
v118->Tcb.AbEntrySummary |= v136;
else
_InterlockedOr8((volatile signed __int8 *)&v118->Tcb.AbOrphanedEntrySummary, v136);
}
--v118->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v118->Tcb, (VOID *)(v5 + 16), (UINT64 *)((char *)&a3 + 4));
v98 = v118->Tcb.SpecialApcDisable++ == -1;
if( v98 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v118->Tcb.ApcState.ApcListHead[0].Flink != &v118->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
v8 = v5 + 16;
}
else
{
if( *(_BYTE *)(v6 + 57) )
{
ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v8);
goto LABEL_157;
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)v8, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)v8);
KeAbPostRelease((VOID *)v8);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
LABEL_158:
Subsegment = (INT64)RtlpHpLfhBucketGetSubsegment(a2, *(unsigned __int8 *)(a1 + 57));
if( !Subsegment )
{
LODWORD(v115) = RtlpHpLfhSubsegmentCreate(a1, a2, (unsigned int)a5);
Subsegment = v115;
if( !v115 )
{
LODWORD(v41) = 0;
goto LABEL_33;
}
}
v7 = 2;
v182 = 2;
v174 = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)v8, *(unsigned __int8 *)(a1 + 57));
v116 = RtlpHpLfhSlotAddSubsegment(v5, Subsegment);
v6 = a1;
v189 = (INT64)v116;
}
v45 = v5 + 24;
v46 = 1;
v47 = *(_QWORD *)(v5 + 24);
if( v9 )
v46 = 4096;
if( v47 == v45 )
goto LABEL_268;
LABEL_43:
v48 = *(_WORD *)(v47 + 32);
v187 = 0;
while( 1 )
{
if( v46 < v48 )
{
v49 = v46;
}
else
{
v49 = v48;
if( v7 == 1 )
{
v47 = *(_QWORD *)v47;
if( v47 == v45 )
{
v8 = v5 + 16;
LABEL_268:
v47 = 0i64;
goto LABEL_64;
}
goto LABEL_43;
}
}
v50 = v48 - v49;
v48 = _InterlockedCompareExchange16((volatile signed __int16 *)(v47 + 32), v48 - v49, v48);
v51 = v49;
v52 = v49 + v50;
if( v48 == v52 )
break;
if( v48 < v52 )
v187 = 1;
}
if( *(_WORD *)(v47 + 32) )
goto LABEL_62;
v53 = (__int64 *)v47;
switch( *(_BYTE *)(v47 + 38) )
{
case 0:
v54 = (_QWORD *)(v5 + 8);
goto LABEL_50;
case 1:
v45 = v5 + 40;
v54 = 0i64;
LABEL_50:
v55 = (__int64 **)(v5 + 40);
if( v45 )
{
v56 = *(_QWORD *)v47;
v57 = *(INT64 **)(v47 + 8);
if( *(_QWORD *)(*(_QWORD *)v47 + 8i64) == v47 && *v57 == v47 )
{
*v57 = v56;
*(_QWORD *)(v56 + 8) = v57;
if( v54 )
--*v54;
goto LABEL_55;
}
LABEL_353:
__fastfail(3u);
}
LABEL_55:
*(_BYTE *)(v47 + 38) = 1;
if( v5 != -40 )
{
v58 = *(INT64 **)(v5 + 48);
if( (__int64 **)*v58 != v55 )
goto LABEL_353;
*(_QWORD *)v47 = v55;
*(_QWORD *)(v47 + 8) = v58;
v53 = 0i64;
*v58 = v47;
*(_QWORD *)(v5 + 48) = v47;
}
if( (*(_BYTE *)v5 & 1) == 0 && *(_QWORD *)(v5 + 8) > 8ui64 )
{
v53 = *v55;
v148 = **v55;
if( (__int64 **)(*v55)[1] != v55 || *(__int64 **)(v148 + 8) != v53 )
goto LABEL_353;
*v55 = (__int64 *)v148;
*(_QWORD *)(v148 + 8) = v55;
--MEMORY[0];
*((_BYTE *)v53 + 38) = 2;
}
if( v53 && *((_BYTE *)v53 + 38) == 2 )
v53[2] = 0i64;
break;
case 2:
v45 = 0i64;
v54 = 0i64;
goto LABEL_50;
}
v6 = a1;
LABEL_62:
v59 = v49 <= 1u;
v8 = v5 + 16;
if( !v59 )
*(_QWORD *)(v5 + 56) = v47 ^ ((unsigned __int16)(v51 - 1) ^ (unsigned __int16)v47) & 0xFFF;
LABEL_64:
if( v7 == 2 )
{
if( *(_BYTE *)(v6 + 57) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v8);
goto LABEL_67;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v8);
LODWORD(a3) = 0;
v90 = (_ETHREAD *)KeGetCurrentThread();
v91 = MiGetSystemRegionType(v8) == 1 ? (void *)(unsigned int)MmGetSessionIdEx(v90->Tcb.ApcState.Process) : (void *)0xFFFFFFFFi64;
--v90->Tcb.SpecialApcDisable;
v95 = ++v90->Tcb.AbAllocationRegionCount;
v96 = ((char)v90->Tcb.AbEntrySummary | (char)v90->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v97 = v8 & 0x7FFFFFFFFFFFFFFCi64;
v98 = !_BitScanReverse((unsigned int *)&v99, v96);
v200 = v99;
if( v98 )
{
LABEL_115:
if( (*(&v90->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v90, (PVOID)v8, v91, 0i64);
}
else
{
while( 1 )
{
v100 = &v90->Tcb.LockEntries[v99];
v96 &= ~(1 << v99);
if( (v100->AcquiredByte & 1) != 0
&& (v100->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v100->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == v97
&& v100->LockState.SessionId == (_DWORD)v91 )
{
v100->AcquiredByte &= ~1u;
if( v100->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v98 = !_BitScanReverse((unsigned int *)&v99, v96);
v200 = v99;
if( v98 )
goto LABEL_114;
}
if( !v100 )
{
LABEL_114:
v8 = v5 + 16;
goto LABEL_115;
}
v100->CrossThreadReleasableAndBusyByte |= 2u;
if( v100->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v100);
LODWORD(a3) = 0;
LODWORD(a3) = v100->BoostBitmap.AllFields & 0x1FFFF;
v100->BoostBitmap.AllFields &= 0xFFFE0000;
v100->ThreadLocalFlags &= ~1u;
v100->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v101 = (unsigned __int128)(((char *)v100 - (char *)v90->Tcb.LockEntries) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
v8 = v5 + 16;
v102 = 1 << ((v101 >> 4) + (v101 < 0));
if( v95 == 1 )
v90->Tcb.AbEntrySummary |= v102;
else
_InterlockedOr8((volatile signed __int8 *)&v90->Tcb.AbOrphanedEntrySummary, v102);
}
--v90->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v90->Tcb, (VOID *)v8, &a3);
v98 = v90->Tcb.SpecialApcDisable++ == -1;
if( v98 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v90->Tcb.ApcState.ApcListHead[0].Flink != &v90->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
else if( *(_BYTE *)(v6 + 57) )
{
ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)v8);
LABEL_67:
__writecr8(v174);
}
else
{
if( _InterlockedCompareExchange64((volatile signed __int64 *)v8, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)v8);
KeAbPostRelease((VOID *)v8);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
if( v47 )
break;
v7 = 2;
v182 = 2;
v149 = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)v8, *(unsigned __int8 *)(a1 + 57));
v6 = a1;
v174 = v149;
}
v60 = 3i64;
v61 = 2 * (*(unsigned __int16 *)(v47 + 34) + (unsigned __int64)*(unsigned __int8 *)(v47 + 39));
v205[1] = v47 + 48;
v62 = *(unsigned __int8 *)(v5 + 1);
v205[0] = v61;
v186 = (unsigned int)v47 >> 12;
LODWORD(v188) = *((unsigned __int8 *)RtlpSearchWidth + v62);
v63 = (unsigned __int16)(WORD4(RtlpHpHeapGlobals) ^ ((unsigned int)v47 >> 12) ^ *(_WORD *)(v47 + 40));
v64 = (DWORD2(RtlpHpHeapGlobals) ^ ((unsigned int)v47 >> 12) ^ *(_DWORD *)(v47 + 40)) >> 16;
v65 = v64;
v66 = v64;
HIDWORD(v199) = v63;
if( v209 >= v63 )
v60 = 1i64;
if( (*(_BYTE *)(a1 + 62) & 2) != 0 )
{
v66 = v64;
v68 = 0i64;
if( v209 >= v63 )
v66 = v64;
}
else
{
v67 = RtlpLfhIncrementDataSlot();
if( v209 >= v63 )
v66 = v65;
v68 = *((unsigned __int8 *)RtlpLowFragHeapRandomData + v67);
}
v69 = RtlpLfhBlockBitmapAllocate(v205, *(unsigned __int16 *)(v47 + 36), v68, (unsigned int)v188, v60);
v185 = v69;
*(_WORD *)(v47 + 36) = v69;
v70 = v66 + v69 * v63;
if( *(_BYTE *)(v47 + 45) <= 1u )
goto LABEL_87;
v71 = *(_BYTE *)(v47 + 44);
v72 = 0i64;
v73 = v47 + *(unsigned __int16 *)(v47 + 46);
v74 = v70 >> v71;
v186 = WORD4(RtlpHpHeapGlobals) ^ (unsigned __int16)v186 ^ *(unsigned __int16 *)(v47 + 40);
HIDWORD(v196) = 0;
v181[0] = -1;
v75 = ((v70 + v186 - 1) >> v71) - (unsigned int)v74 + 1;
v176 = -1;
v76 = 2 * v74;
v77 = (signed __int16 *)(2 * v74 + v73);
_m_prefetchw(v77);
v184 = 0i64;
v78 = &v77[v75];
v182 = 0;
v178 = -1;
if( v77 >= v78 )
goto LABEL_87;
v79 = (unsigned __int64)v78;
do
{
while( 1 )
{
v80 = *v77;
while( v80 > 0 )
{
v81 = v80;
v80 = _InterlockedCompareExchange16(v77, v80 + 1, v80);
if( v81 == v80 )
{
v82 = v182;
v83 = v178;
LODWORD(v84) = v184;
goto LABEL_82;
}
}
if( (_DWORD)v72 )
break;
LODWORD(v188) = 1;
v117 = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)(v47 + 24), *(unsigned __int8 *)(a1 + 57));
v72 = 1i64;
v176 = v117;
}
v83 = v178;
if( v80 )
{
v82 = v182 + 1;
v84 = v76 >> 1;
++v182;
v184 = v76 >> 1;
if( v178 == -1 )
{
v83 = v76 >> 1;
v178 = v83;
}
}
else
{
LODWORD(v84) = v184;
v82 = --v182;
}
*v77 = v80 + 1;
LABEL_82:
++v77;
v76 += 2i64;
}
while( (unsigned __int64)v77 < v79 );
v63 = HIDWORD(v199);
v85 = v185;
if( v82 )
{
v86 = a1;
if( (RtlpHpLfhPerfFlags & 0x20) != 0 )
_InterlockedExchangeAdd64(
(volatile signed __int64 *)(*(__int16 *)(a1 + 58) + a1 + 24),
(v82 << *(_BYTE *)(v47 + 44)) / 4096);
}
else
{
v86 = a1;
}
if( v83 == -1 )
{
if( (_DWORD)v72 )
{
if( *(_BYTE *)(v86 + 57) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v47 + 24));
__writecr8(v176);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v47 + 24), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v47 + 24));
LODWORD(v199) = 0;
v130 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v47 + 24) == 1 )
v131 = (unsigned int)MmGetSessionIdEx(v130->Tcb.ApcState.Process);
else
v131 = 0xFFFFFFFFi64;
--v130->Tcb.SpecialApcDisable;
v142 = ++v130->Tcb.AbAllocationRegionCount;
v143 = ((char)v130->Tcb.AbEntrySummary | (char)v130->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v98 = !_BitScanReverse((unsigned int *)&v144, v143);
HIDWORD(v198) = v144;
if( v98 )
goto LABEL_242;
while( 1 )
{
v145 = &v130->Tcb.LockEntries[v144];
v143 &= ~(1 << v144);
if( (v145->AcquiredByte & 1) != 0
&& (v145->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v145->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((v47 + 24) & 0x7FFFFFFFFFFFFFFCi64)
&& v145->LockState.SessionId == (_DWORD)v131 )
{
v145->AcquiredByte &= ~1u;
if( v145->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v98 = !_BitScanReverse((unsigned int *)&v144, v143);
HIDWORD(v198) = v144;
if( v98 )
goto LABEL_242;
}
if( !v145 )
{
LABEL_242:
if( (*(&v130->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v130, (PVOID)(v47 + 24), (PVOID)v131, 0i64);
}
else
{
v145->CrossThreadReleasableAndBusyByte |= 2u;
if( v145->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v145);
LODWORD(v199) = v145->BoostBitmap.AllFields & 0x1FFFF;
v145->BoostBitmap.AllFields &= 0xFFFE0000;
v145->ThreadLocalFlags &= ~1u;
v145->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v146 = 1 << (v145 - v130->Tcb.LockEntries);
if( v142 == 1 )
v130->Tcb.AbEntrySummary |= v146;
else
_InterlockedOr8((volatile signed __int8 *)&v130->Tcb.AbOrphanedEntrySummary, v146);
}
--v130->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v130->Tcb, (VOID *)(v47 + 24), &v199);
v98 = v130->Tcb.SpecialApcDisable++ == -1;
if( v98 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v130->Tcb.ApcState.ApcListHead[0].Flink != &v130->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
}
LABEL_87:
v41 = v47 + v70;
if( v209 < v63 )
RtlpHpLfhSubsegmentSetUnusedBytes(v47, v47 + v70, v63 - v209);
v87 = a1;
}
else
{
v122 = v84 - v83;
v123 = *(_BYTE *)(v47 + 44);
v124 = (int(__fastcall *)(__int64, INT64, _QWORD, __int64))(v86 ^ RtlpHpHeapGlobals ^ *(_QWORD *)(v86 + 24));
v125 = v83 << v123;
HIDWORD(v196) = v122 + 1;
v126 = (v122 + 1) << v123;
v127 = *(_QWORD *)v86;
v181[0] = v176;
v179 = v125;
if( v124(v127, v47 + v125, v126, v72) >= 0 )
{
RtlpHpLfhSubsegmentIncBlockCounts(a1, v47, v179, v126, (_DWORD *)&v196 + 1, 1, (UINT8 *)v181);
goto LABEL_87;
}
v87 = a1;
RtlpHpLfhSubsegmentDecBlockCounts(a1, v47, v70, v186);
if( *(_BYTE *)(a1 + 57) )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v47 + 24));
__writecr8(v176);
v41 = 0i64;
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v47 + 24), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(v47 + 24));
v41 = 0i64;
LODWORD(v198) = 0;
v167 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v47 + 24) == 1 )
v168 = MmGetSessionIdEx(v167->Tcb.ApcState.Process);
else
v168 = -1;
--v167->Tcb.SpecialApcDisable;
v169 = ++v167->Tcb.AbAllocationRegionCount;
v170 = ((char)v167->Tcb.AbEntrySummary | (char)v167->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v98 = !_BitScanReverse((unsigned int *)&v171, v170);
v197 = v171;
if( v98 )
{
LABEL_378:
if( (*(&v167->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v167, (PVOID)(v47 + 24), (PVOID)v168, 0i64);
}
else
{
while( 1 )
{
v172 = &v167->Tcb.LockEntries[v171];
v170 &= ~(1 << v171);
if( (v172->AcquiredByte & 1) != 0
&& (v172->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v172->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((v47 + 24) & 0x7FFFFFFFFFFFFFFCi64)
&& v172->LockState.SessionId == v168 )
{
v172->AcquiredByte &= ~1u;
if( v172->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v98 = !_BitScanReverse((unsigned int *)&v171, v170);
v197 = v171;
if( v98 )
goto LABEL_377;
}
if( !v172 )
{
LABEL_377:
v41 = 0i64;
goto LABEL_378;
}
v172->CrossThreadReleasableAndBusyByte |= 2u;
if( v172->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v172);
LODWORD(v198) = v172->BoostBitmap.AllFields & 0x1FFFF;
v172->BoostBitmap.AllFields &= 0xFFFE0000;
v172->ThreadLocalFlags &= ~1u;
v172->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v173 = 1 << ((char)((_BYTE)v172 - LOBYTE(v167->Tcb.LockEntries)) / 96);
if( v169 == 1 )
v167->Tcb.AbEntrySummary |= v173;
else
_InterlockedOr8((volatile signed __int8 *)&v167->Tcb.AbOrphanedEntrySummary, v173);
v41 = 0i64;
}
--v167->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v167->Tcb, (VOID *)(v47 + 24), &v198);
v98 = v167->Tcb.SpecialApcDisable++ == -1;
if( v98 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v167->Tcb.ApcState.ApcListHead[0].Flink != &v167->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
v87 = a1;
}
if( v85 != -1 )
_InterlockedAnd64(
(volatile signed __int64 *)(v47 + 8 * ((unsigned __int64)(2 * v85) >> 6) + 48),
~(3i64 << ((2 * v85) & 0x3F)));
}
if( !v41 )
RtlpHpLfhSubsegmentFreeBlock(v87, v47, 0i64, a5);
LABEL_32:
Subsegment = v189;
LABEL_33:
if( v187 )
RtlpHpLfhBucketUpdateAffinityMapping((PLIST_ENTRY)a1);
if( Subsegment )
RtlpHpLfhBucketAddSubsegment(a1, a2, Subsegment, a5);
return v41;
}Referenced by:
ExAllocateHeapPool
RtlpHpLfhBucketAllocate