ExAllocateHeapPool

VOID *__fastcall ExAllocateHeapPool(UINT64 PoolType, UINT64 NumberOfBytes, UINT64 Tag, UINT64 P2, UINT64 arg20){
  VOID *v5; 
  unsigned __int64 v6; 
  unsigned int v7; 
  unsigned int v8; 
  _XSTATE_CONFIGURATION *v9; 
  int v10; 
  __int64 v11; 
  int v12; 
  char v13; 
  unsigned int v14; 
  __int64 *v15; 
  __int64 v16; 
  INT64 v17; 
  unsigned __int64 p_Size; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  unsigned int v21; 
  INT64 v22; 
  int v23; 
  unsigned __int64 v24; 
  int v25; 
  unsigned int v26; 
  __int64 v27; 
  __int64 v28; 
  INT64 v29; 
  bool v30; 
  unsigned __int8 v31; 
  VOID *v32; 
  INT64 v33; 
  INT64 Internal; 
  unsigned __int32 v35; 
  int v36; 
  int v37; 
  __int64 v38; 
  char *v39; 
  unsigned int v40; 
  unsigned int v41; 
  __int64 v42; 
  int v43; 
  volatile signed __int32 *v44; 
  __int64 v45; 
  __int64 v46; 
  __int64 v48; 
  unsigned int v49; 
  __int64 v50; 
  unsigned __int16 *v51; 
  unsigned int v52; 
  INT64 v53; 
  __int64 v54; 
  unsigned __int64 v55; 
  INT64 v56; 
  unsigned __int64 v57; 
  int v58; 
  unsigned int v59; 
  int v60; 
  unsigned __int64 v61; 
  unsigned int v62; 
  unsigned int v63; 
  _XSTATE_CONFIGURATION *v64; 
  INT64 v65; 
  __int64 v66; 
  int v67; 
  __int64 v68; 
  char *v69; 
  unsigned int v70; 
  int v71; 
  __int64 v72; 
  int v73; 
  volatile signed __int32 *v74; 
  __int64 v75; 
  __int64 v76; 
  UINT16 *v77; 
  unsigned int v78; 
  unsigned int v79; 
  unsigned int v80; 
  unsigned int v81; 
  NTSTATUS v82; 
  _SLIST_ENTRY *v83; 
  ULONG v84; 
  volatile signed __int32 v85; 
  int v86; 
  UINT64 v87; 
  volatile signed __int32 v88; 
  _XSTATE_CONFIGURATION *v89; 
  unsigned __int64 v90; 
  UINT64 HeapSpecialPool; 
  VOID *v92; 
  UINT16 *v93; 
  UINT64 v94; 
  VOID *v95; 
  UINT16 *v96; 
  UINT64 v97; 
  UINT64 v98; 
  UINT64 NumberOfBytesa; 
  INT64 Pattern; 
  _XSTATE_CONFIGURATION *Va; 
  unsigned int Vaa; 
  int v103; 
  int v104; 
  __int64 v105; 
  __int64 v106; 
  char *v107; 
  INT64 *v108; 
  int v109; 
  __int64 v110; 
  int v111; 
  int v112; 
  INT64 v113; 
  INT64 a5; 
  INT64 v115; 
  PSLIST_ENTRY ListEnd; 
  _KLOCK_QUEUE_HANDLE v117; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  INT64 v119[2]; 
  __int64 v120; 
  INT64 v121[2]; 
  __int64 v122; 
  __int64 v123; 
  __int64 v124; 
  VOID *retaddr; 
  unsigned int Key; 

  v5 = 0i64;
  v6 = (unsigned int)P2;
  Va = 0i64;
  v7 = ((unsigned int)PoolType >> 9) & 2;
  v8 = Tag;
  v9 = (_XSTATE_CONFIGURATION *)NumberOfBytes;
  v10 = PoolType;
  if( (PoolType & 0x44) == 68 )
    v10 = PoolType & 0xFFFFFFFB;
  v11 = 1i64;
  v12 = v10 | 0x200;
  if( (ExpPoolFlags & 0x400) == 0 || (v10 & 0x201) != 0 )
    v12 = v10;
  if( (ExpPoolFlags & 8) == 0 )
    goto LABEL_6;
  if( (v12 & 0x80000080) != 0 )
  {
    v12 &= ~0x80u;
    if( v12 < 0 )
    {
      v13 = arg20;
      if( (MmVerifierData & 1) != 0 )
        v13 = 1;
LABEL_7:
      v14 = v8 & 0x7FFFFFFF;
      Key = v14;
      if( !v14 )
      {
        v14 = 811884866;
        Key = 811884866;
      }
      if( NumberOfBytes <= 0xFE0
        && ((_DWORD)MmSpecialPoolTag
         && NumberOfBytes
         && ((unsigned int)ExCheckSingleFilter(v14, (unsigned int)MmSpecialPoolTag)
          || v90 >= (unsigned __int64)&v9->Size && v90 < (unsigned __int64)&v9->Features[1])
         || ((unsigned __int8)v13 & (unsigned __int8)v11) != 0) )
      {
        HeapSpecialPool = ExAllocateHeapSpecialPool((unsigned int)v12, v9, (_XSTATE_CONFIGURATION *)v14);
        Va = (_XSTATE_CONFIGURATION *)HeapSpecialPool;
        if( HeapSpecialPool )
        {
          if( _InterlockedIncrement(&ExpSpecialAllocations) == 1 )
            _InterlockedIncrement((_DWORD *)&stru_140C4DB30 + 1082);
          v5 = (VOID *)HeapSpecialPool;
          goto LABEL_65;
        }
        v11 = 1i64;
      }
      if( !v9 )
        v9 = (_XSTATE_CONFIGURATION *)v11;
      if( (_DWORD)v6 == 0x80000000 )
        goto LABEL_195;
      if( (unsigned int)v6 >= (unsigned __int16)KeNumberNodes )
        KeBugCheckEx(0xC2u, (PVOID)0xE, (PVOID)v6, (PVOID)(v12 & 0xFFFFFFFFFFFFFF7Fui64), (PVOID)v14);
      if( (_DWORD)v6 == 0x80000000 )
LABEL_195:
        LODWORD(v6) = KeGetCurrentPrcb()->ParentNode->Affinity.Reserved[0];
      if( (unsigned int)v6 >= dword_140C57DD0 )
        LODWORD(v6) = 0;
      v15 = &qword_140C57E00[1048 * (unsigned int)v6];
      if( v12 < 0 )
      {
        v17 = v15[3];
      }
      else if( (v12 & 0x21) == 33 )
      {
        v17 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread()->ApcState.Process->Session + 84) + 14560i64);
      }
      else
      {
        if( (v12 & 1) != 0 )
        {
          v16 = 2i64;
        }
        else
        {
          v16 = 0i64;
          if( (v12 & 0x200) != 0 )
            v16 = v11;
        }
        v17 = v15[v16];
      }
      if( (unsigned __int64)v9 <= 0xFE0 )
      {
        p_Size = (unsigned __int64)&v9->Size;
        if( (v12 & 4) != 0 )
        {
          p_Size += *(unsigned int *)((char *)&Mm64BitPhysicalAddress + 7);
          if( p_Size > 0xFE0 )
          {
            p_Size -= *(unsigned int *)((char *)&Mm64BitPhysicalAddress + 7);
            LOWORD(v12) = v12 & 0xFFFB;
          }
        }
        v19 = (p_Size + 15) & 0xFFFFFFFFFFFFFFF0ui64;
        if( v19 < 0x201 )
          goto LABEL_27;
        if( v19 > 0xF80 )
          goto LABEL_27;
        v48 = *((unsigned __int8 *)RtlpLfhBucketIndexMap + ((unsigned int)v19 >> 4));
        v19 = (unsigned __int16)word_140010F30[v48];
        v49 = v48 - 33;
        v50 = *(_QWORD *)(v17 + 40);
        if( !v50 )
          goto LABEL_27;
        v51 = (unsigned __int16 *)(v50 + ((v49 + 1i64) << 6));
        ++*((_DWORD *)v51 + 5);
        if( !*v51 || (Internal = (INT64)RtlpInterlockedPopEntrySList((PSLIST_HEADER)(v50 + ((v49 + 1i64) << 6)))) == 0 )
        {
          ++*((_DWORD *)v51 + 6);
          Internal = 0i64;
        }
        if( !Internal )
        {
          v78 = v51[8];
          v79 = *v51;
          a5 = 0i64;
          ListEnd = 0i64;
          v80 = 0;
          if( v79 < v78 )
            v80 = v78 - v79;
          v81 = v80 >> 1;
          if( v81 )
          {
            v82 = RtlpHpVsContextMultiAlloc(
                    (INT64 *)(v17 + 640),
                    (unsigned int)v19,
                    v81 + 1,
                    0i64,
                    (INT64)&a5,
                    (INT64)&ListEnd);
            if( v82 )
            {
              Internal = a5;
              v83 = *(_SLIST_ENTRY **)a5;
              a5 = *(_QWORD *)a5;
              v84 = v82 - 1;
              if( v84 )
                InterlockedPushListSList((PSLIST_HEADER)v51, v83, ListEnd, v84);
            }
            else
            {
              Internal = 0i64;
            }
          }
          else
          {
            Internal = 0i64;
          }
        }
        if( (v12 & 0x400) != 0 )
        {
          if( !Internal )
          {
LABEL_80:
            v11 = 1i64;
LABEL_27:
            v20 = *(_QWORD *)(v17 + 48);
            v21 = (v7 | *(_DWORD *)(v17 + 20)) & 0x93000F0B;
            if( (v20 || (v20 = qword_140C1DC28) != 0) && v19 > v20 )
            {
              v95 = *(VOID **)(v17 + 56);
              if( v95 )
                RtlpLogHeapFailure(heap_failure_allocation_limit, (VOID *)v17, 0i64, v95, (VOID *)v19);
              goto LABEL_175;
            }
            v103 = 0;
            v22 = 0i64;
            v115 = 0i64;
            if( (v21 & 0x1000000) != 0 )
              goto LABEL_31;
            v23 = *(_DWORD *)(v17 + 24);
            v103 = v23;
            if( !v23 )
              goto LABEL_31;
            v21 |= 8u;
            if( (_WORD)v23 == 1
              && ((__int64(__fastcall *)(INT64, _QWORD, _QWORD, INT64 *))RtlpInterceptorRoutines.QuadPart)(
                   v17,
                   0i64,
                   (unsigned int)v11,
                   &v115) >= 0 )
            {
              v22 = v115;
              v11 = 1i64;
LABEL_31:
              v24 = v22 + v19;
              if( (v21 & 0x10000000) != 0 )
                v24 += 16i64;
              if( (v21 & 0x20000F08) != 0 )
                v24 = ((v24 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 16;
              if( !v24 )
                v24 = v11;
              if( v24 < v19 || v19 > 0x7FFFFFFFFFFFFFFFi64 )
              {
                Internal = 0i64;
              }
              else
              {
                v25 = v21 & 0x13000003;
                if( v24 > (unsigned int)*(unsigned __int16 *)(v17 + 892) - 16 )
                  goto LABEL_124;
                v26 = v24;
                if( (_DWORD)v19 != (_DWORD)v24 )
                  v26 = v24 + 2;
                v108 = (INT64 *)(v17
                               + 832
                               + 8 * (*((unsigned __int8 *)RtlpLfhBucketIndexMap + ((v26 + 15) >> 4)) + 16i64));
                if( (*v108 & 1) == 0
                  || (LOBYTE(v86) = RtlpHpLfhBucketUpdateStats(v17 + 832, v26, (unsigned int)v11),
                      v25 = v21 & 0x13000003,
                      v86) )
                {
                  v27 = 128i64;
                  v28 = *(unsigned __int8 *)(v17 + 888);
                  v29 = *v108;
                  if( (RtlpHpLfhPerfFlags & 0x400) != 0 )
                    v27 = 192i64;
                  v123 = v27;
                  v30 = *(_BYTE *)(v29 + 2) == 1;
                  v124 = v27 + v28 - (((_BYTE)v28 - 1) & 7) + 7;
                  if( v30 )
                    v31 = 0;
                  else
                    v31 = *(_BYTE *)(BYTE5(KeGetCurrentThread()[1].Ucb) + v27 + v29);
                  LODWORD(NumberOfBytesa) = v25;
                  LODWORD(v32) = RtlpHpLfhSlotAllocate(
                                   v17 + 832,
                                   v29,
                                   *(_QWORD *)(v27 + v28 - (((_BYTE)v28 - 1) & 7) + 7 + v29 + 8i64 * v31),
                                   (unsigned int)v19,
                                   NumberOfBytesa);
                  v25 = v21 & 0x13000003;
                  Internal = (INT64)v32;
                  if( v32 && (v21 & 2) != 0 )
                  {
                    memset(v32, 0i64, v19);
                    v25 = v21 & 0x13000003;
                  }
                }
                else
                {
                  Internal = -1i64;
                }
                if( Internal == -1 )
                {
LABEL_124:
                  if( v24 > 0x20000 )
                  {
                    if( v24 > *(unsigned int *)(v17 + 464) )
                    {
                      LODWORD(v97) = RtlpHpLargeAlloc(v17, v19, v24, v25);
                    }
                    else
                    {
                      v96 = (UINT16 *)(v17 + 256);
                      if( v24 > *(unsigned int *)(v17 + 272) )
                        v96 = (UINT16 *)(v17 + 448);
                      LODWORD(NumberOfBytesa) = v25;
                      v97 = RtlpHpSegAlloc(v96, v19, v24, v24, NumberOfBytesa);
                    }
                    Internal = v97;
                  }
                  else
                  {
                    v112 = 0;
                    v122 = 0i64;
                    *(_OWORD *)v121 = 0i64;
                    Internal = (INT64)RtlpHpVsContextAllocateInternal(
                                        v17 + 640,
                                        v19,
                                        v24,
                                        v25,
                                        (INT64)v121,
                                        (__int64)&v112);
                    if( v112 && (v21 & 1) == 0 )
                      RtlpHpReleaseQueuedLockExclusive(*(unsigned int *)(v17 + 648), (INT64)v121);
                  }
                }
                if( !Internal )
                  goto LABEL_175;
                if( (v21 & 0x30000F08) != 0 )
                {
                  LODWORD(Pattern) = v21;
                  v98 = RtlpHpExtrasAppend((INT128 *)v17, (_XSTATE_CONFIGURATION *)Internal, v19, v33, v115, Pattern, 0);
                  if( v103 )
                  {
                    *(_BYTE *)(v98 + 2) ^= (*(_BYTE *)(v98 + 2) ^ v103) & 0xF;
                    if( (_WORD)v103 != 1
                      || ((__int64(__fastcall *)(INT64, INT64, __int64, UINT64))RtlpInterceptorRoutines.QuadPart)(
                           v17,
                           Internal,
                           2i64,
                           v98 + 16) < 0 )
                    {
                      RtlpHpFreeHeap((VOID *)v17, (VOID *)Internal, v21);
                      goto LABEL_175;
                    }
                  }
                }
              }
              if( !Internal )
                goto LABEL_175;
              goto LABEL_54;
            }
LABEL_175:
            if( Va )
              RtlpHpFreeHeap((VOID *)v17, Va, 0i64);
            goto LABEL_229;
          }
          memset((VOID *)Internal, 0i64, v19);
        }
        if( Internal )
        {
LABEL_54:
          v35 = Key;
          *(_BYTE *)(Internal + 2) = v19 >> 4;
          *(_DWORD *)(Internal + 4) = Key;
          *(_BYTE *)Internal = 0;
          *(_QWORD *)&LockHandle.OldIrql = 0i64;
          *(_BYTE *)(Internal + 3) = v12 & 0x6D | 2;
          LockHandle.LockQueue = 0i64;
          if( Key == PoolHitTag )
            __debugbreak();
          v36 = v12 & 0x20;
          if( (v12 & 0x20) != 0 )
          {
            v39 = (char *)ExpSessionPoolTrackTable;
            v37 = ExpSessionPoolTrackTableMask;
            v38 = ExpSessionPoolTrackTableSize;
          }
          else
          {
            v37 = PoolTrackTableMask;
            v38 = PoolTrackTableSize;
            v39 = (char *)*((_QWORD *)&WheapDeferredInternalLogsEventLock + KeGetPcr()->Prcb.Number + 372);
          }
          v106 = v38;
          v109 = v37;
          v40 = v37 & ((40543 * Key) ^ ((40543 * (unsigned __int64)Key) >> 32));
          v41 = v40;
          Vaa = v40;
          while( 1 )
          {
            while( 1 )
            {
              while( 1 )
              {
                v42 = 56i64 * v40;
                v43 = *(_DWORD *)&v39[v42];
                v44 = (volatile signed __int32 *)&v39[v42];
                if( v43 == v35 )
                {
                  if( (v12 & 1) != 0 )
                  {
                    v45 = 8i64;
                    v46 = 10i64;
                  }
                  else
                  {
                    v45 = 2i64;
                    v46 = 4i64;
                  }
                  _InterlockedIncrement64((volatile signed __int64 *)&v44[v46]);
                  _InterlockedExchangeAdd64((volatile signed __int64 *)&v44[v45], v19);
LABEL_63:
                  if( (v12 & 4) != 0 )
                  {
                    *(_BYTE *)(Internal + 3) &= ~4u;
                    v52 = (*(_DWORD *)((char *)&Mm64BitPhysicalAddress + 7) - 1) & (-16 - Internal);
                    if( v52 )
                    {
                      v53 = Internal + v52;
                      v54 = (__int64)v52 >> 4;
                      *(_BYTE *)v53 = v54;
                      *(_BYTE *)(v53 + 2) = *(_BYTE *)(Internal + 2) - v54;
                      *(_BYTE *)(v53 + 1) = *(_BYTE *)(Internal + 1);
                      *(_BYTE *)(v53 + 3) = *(_BYTE *)(Internal + 3) | 4;
                      *(_DWORD *)(v53 + 4) = *(_DWORD *)(Internal + 4);
                      if( (unsigned __int8)*(_WORD *)v53 > 1u )
                        *(_QWORD *)(Internal + 16) = ExpPoolQuotaCookie ^ v53;
                      Internal = v53;
                    }
                  }
                  v5 = (VOID *)(Internal + 16);
LABEL_65:
                  if( v5 )
                    return v5;
LABEL_229:
                  if( (v12 & 0x10) != 0 )
                    RtlRaiseStatus(-1073741670);
                  return v5;
                }
                if( !v43 )
                  break;
LABEL_70:
                v40 = v37 & (v40 + 1);
                if( v40 == v41 )
                {
                  ExpInsertPoolTrackerExpansion(v35, v19, (POOL_TYPE)(v12 & 0x6D | 2));
                  goto LABEL_63;
                }
              }
              if( !v36 )
                break;
LABEL_147:
              if( v40 == v38 - 1 )
                goto LABEL_70;
              if( v36 )
              {
                _InterlockedCompareExchange(v44, v35, 0);
              }
              else
              {
                KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&ExpTaggedPoolLock, &LockHandle);
                if( !*(_DWORD *)(*(&WheapDeferredInternalLogsEventLock + 371) + 56i64 * v40) )
                {
                  *(_DWORD *)(*(&WheapDeferredInternalLogsEventLock + 371) + 56i64 * v40) = Key;
                  *v44 = Key;
                }
                KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
                __writecr8(LockHandle.OldIrql);
                v36 = v12 & 0x20;
                v35 = Key;
                v37 = v109;
                v41 = Vaa;
                v38 = v106;
              }
            }
            v85 = *(_DWORD *)(v42 + *(&WheapDeferredInternalLogsEventLock + 371));
            if( !v85 )
            {
              v38 = v106;
              goto LABEL_147;
            }
            *v44 = v85;
            v38 = v106;
          }
        }
        goto LABEL_80;
      }
      v55 = ((unsigned __int64)&v9->EnabledVolatileFeatures + 7) & 0xFFFFFFFFFFFFFFF0ui64;
      if( v55 >= 0x10000 || (((_WORD)v9 + 15) & 0xFF0u) > 0xFC0 )
        v55 = (v55 + 4095) & 0xFFFFFFFFFFFFF000ui64;
      if( v55 < (unsigned __int64)v9 )
        goto LABEL_175;
      if( (v55 & 0xFFF) == 0 && v55 <= *(unsigned int *)(v17 + 464) )
      {
        v77 = (UINT16 *)(v17 + 256);
        if( v55 > *(unsigned int *)(v17 + 272) )
          v77 = (UINT16 *)(v17 + 448);
        LODWORD(NumberOfBytesa) = ((unsigned int)v12 >> 9) & 2;
        v64 = (_XSTATE_CONFIGURATION *)RtlpHpSegAlloc(v77, v55, v55, v55, NumberOfBytesa);
        Va = v64;
        goto LABEL_112;
      }
      v56 = 0i64;
      v57 = *(_QWORD *)(v17 + 48);
      v58 = v7 | *(_DWORD *)(v17 + 20);
      v113 = 0i64;
      v59 = v58 & 0x93000F0B;
      if( (v57 || (v57 = qword_140C1DC28) != 0) && v55 > v57 )
      {
        v92 = *(VOID **)(v17 + 56);
        if( v92 )
          RtlpLogHeapFailure(heap_failure_allocation_limit, (VOID *)v17, 0i64, v92, (VOID *)v55);
        goto LABEL_173;
      }
      v104 = 0;
      if( (v59 & 0x1000000) == 0 )
      {
        v60 = *(_DWORD *)(v17 + 24);
        v104 = v60;
        if( v60 )
        {
          v59 |= 8u;
          if( (_WORD)v60 != 1
            || ((__int64(__fastcall *)(INT64, _QWORD, _QWORD, INT64 *))RtlpInterceptorRoutines.QuadPart)(
                 v17,
                 0i64,
                 (unsigned int)v11,
                 &v113) < 0 )
          {
LABEL_173:
            v64 = 0i64;
            Va = 0i64;
LABEL_112:
            if( !v64 )
              goto LABEL_229;
            LOWORD(NumberOfBytesa) = 0;
            if( !ExpAddTagForBigPages(v64, v14, v55, (POOL_TYPE)v12, NumberOfBytesa, 0) )
              goto LABEL_175;
            memset(&v117, 0, sizeof(v117));
            if( v14 == PoolHitTag )
              __debugbreak();
            v66 = (unsigned int)*(&PerfGlobalGroupMask + 1);
            if( (v12 & 0x20) != 0 )
            {
              v69 = (char *)ExpSessionPoolTrackTable;
              v67 = ExpSessionPoolTrackTableMask;
              v68 = ExpSessionPoolTrackTableSize;
            }
            else
            {
              LODWORD(v66) = KeGetPcr()->Prcb.Number;
              v67 = PoolTrackTableMask;
              v68 = PoolTrackTableSize;
              v69 = (char *)*((_QWORD *)&WheapDeferredInternalLogsEventLock + v66 + 372);
            }
            v105 = v68;
            v107 = v69;
            v70 = v67 & ((40543 * v14) ^ ((40543 * (unsigned __int64)v14) >> 32));
            v71 = v70;
            while( 1 )
            {
              v72 = 56i64 * v70;
              v73 = *(_DWORD *)&v69[v72];
              v74 = (volatile signed __int32 *)&v69[v72];
              v110 = v72;
              if( v73 == v14 )
              {
                if( (v12 & 1) != 0 )
                {
                  v75 = 8i64;
                  v76 = 10i64;
                }
                else
                {
                  v75 = 2i64;
                  v76 = 4i64;
                }
                _InterlockedIncrement64((volatile signed __int64 *)&v74[v76]);
                _InterlockedExchangeAdd64((volatile signed __int64 *)&v74[v75], v55);
                v5 = Va;
                goto LABEL_65;
              }
              if( v73 )
              {
LABEL_139:
                v70 = v67 & (v70 + 1);
                if( v70 == v71 )
                {
                  ExpInsertPoolTrackerExpansion(v14, v55, (POOL_TYPE)v12);
                  v5 = Va;
                  goto LABEL_65;
                }
              }
              else if( (v12 & 0x20) != 0
                     || (v88 = *(_DWORD *)(v72 + *(&WheapDeferredInternalLogsEventLock + 371))) == 0 )
              {
                if( v70 == v68 - 1 )
                  goto LABEL_139;
                if( (v12 & 0x20) != 0 )
                {
                  _InterlockedCompareExchange(v74, v14, 0);
                }
                else
                {
                  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&ExpTaggedPoolLock, &v117);
                  if( !*(_DWORD *)(v110 + *(&WheapDeferredInternalLogsEventLock + 371)) )
                  {
                    *(_DWORD *)(v110 + *(&WheapDeferredInternalLogsEventLock + 371)) = v14;
                    *v74 = v14;
                  }
                  KeReleaseInStackQueuedSpinLockFromDpcLevel(&v117);
                  __writecr8(v117.OldIrql);
                  v69 = v107;
                  v71 = v67 & ((40543 * v14) ^ ((40543 * (unsigned __int64)v14) >> 32));
                  v68 = v105;
                }
              }
              else
              {
                *v74 = v88;
              }
            }
          }
          v56 = v113;
          v11 = 1i64;
        }
      }
      v61 = v56 + v55;
      if( (v59 & 0x10000000) != 0 )
        v61 += 16i64;
      if( (v59 & 0x20000F08) != 0 )
        v61 = ((v61 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 16;
      if( !v61 )
        v61 = v11;
      if( v61 < v55 || v55 > 0x7FFFFFFFFFFFFFFFi64 )
        goto LABEL_173;
      v62 = v59 & 0x13000003;
      v63 = v61;
      if( v61 <= (unsigned int)*(unsigned __int16 *)(v17 + 892) - 16 )
      {
        LODWORD(v89) = RtlpHpLfhContextAllocate(v17 + 832, (unsigned int)v55, (unsigned int)v61, v62);
        Va = v89;
        v64 = v89;
        v63 = v61;
        if( v89 != (_XSTATE_CONFIGURATION *)-1i64 )
        {
LABEL_110:
          if( v64 && (v59 & 0x30000F08) != 0 )
          {
            LODWORD(Pattern) = v59;
            v94 = RtlpHpExtrasAppend((INT128 *)v17, v64, v55, v65, v113, Pattern, 0);
            if( v104 )
            {
              *(_BYTE *)(v94 + 2) ^= (*(_BYTE *)(v94 + 2) ^ v104) & 0xF;
              if( (_WORD)v104 == 1
                && ((__int64(__fastcall *)(INT64, _XSTATE_CONFIGURATION *, __int64, UINT64))RtlpInterceptorRoutines.QuadPart)(
                     v17,
                     Va,
                     2i64,
                     v94 + 16) >= 0 )
              {
                v64 = Va;
              }
              else
              {
                NumberOfBytesa = 0i64;
                RtlpHpFreeHeap((VOID *)v17, Va, v59);
                v64 = 0i64;
                Va = 0i64;
              }
            }
            else
            {
              v64 = Va;
            }
          }
          goto LABEL_112;
        }
        v62 = v59 & 0x13000003;
      }
      if( v61 > 0x20000 )
      {
        if( v61 <= *(unsigned int *)(v17 + 464) )
        {
          v93 = (UINT16 *)(v17 + 256);
          if( v61 > *(unsigned int *)(v17 + 272) )
            v93 = (UINT16 *)(v17 + 448);
          LODWORD(NumberOfBytesa) = v62;
          v87 = RtlpHpSegAlloc(v93, v55, v61, v61, NumberOfBytesa);
        }
        else
        {
          LODWORD(v87) = RtlpHpLargeAlloc(v17, v55, v61, v62);
        }
        Va = (_XSTATE_CONFIGURATION *)v87;
        v64 = (_XSTATE_CONFIGURATION *)v87;
      }
      else
      {
        v111 = 0;
        v120 = 0i64;
        *(_OWORD *)v119 = 0i64;
        v64 = (_XSTATE_CONFIGURATION *)RtlpHpVsContextAllocateInternal(
                                         v17 + 640,
                                         v55,
                                         v63,
                                         v62,
                                         (INT64)v119,
                                         (__int64)&v111);
        Va = v64;
        if( v111 && (v59 & 1) == 0 )
        {
          RtlpHpReleaseQueuedLockExclusive(*(unsigned int *)(v17 + 648), (INT64)v119);
          v64 = Va;
        }
      }
      goto LABEL_110;
    }
LABEL_6:
    v13 = arg20;
    goto LABEL_7;
  }
  return VeAllocatePoolWithTagPriority((POOL_TYPE)v12, NumberOfBytes, v8, HighPoolPriority, retaddr);
}

Referenced by:

ExAllocatePoolWithTag
ExpAllocatePoolWithTagFromNode