ExpInsertPoolTrackerExpansion

VOID __stdcall ExpInsertPoolTrackerExpansion(UINT64 Key, UINT64 NumberOfBytes, POOL_TYPE PoolType){
  int v4; 
  char v5; 
  __int64 v6; 
  _DWORD *v7; 
  __int64 v8; 
  _MM_SESSION_SPACE *Session; 
  _DWORD *v10; 
  unsigned __int64 v11; 
  unsigned int v12; 
  __int64 v13; 
  int v14; 
  _QWORD *v15; 
  char *HeapPages; 
  char *v17; 
  _MM_SESSION_SPACE *v18; 
  __int64 v19; 
  int v20; 
  int v21; 
  unsigned int v22; 
  int v23; 
  int v24; 
  INT64 v25; 
  char *v26; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  __int64 v30; 
  unsigned __int64 Size; 
  __int64 v32; 
  int v33; 
  INT64 v34; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  _KLOCK_QUEUE_HANDLE v36; 
  unsigned int Keya; 
  int v39; 
  int v40; 

  Keya = Key;
  v4 = Key;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v5 = PoolType;
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&ExpTaggedPoolLock, &LockHandle);
  v6 = 32i64;
  v39 = v5 & 0x20;
  if( (v5 & 0x20) != 0 )
  {
    v7 = ExpSessionPoolTrackTable;
    v8 = ExpSessionPoolTrackTableSize;
    Session = KeGetCurrentThread()->ApcState.Process->Session;
    v10 = (_DWORD *)*((_QWORD *)Session + 122);
    v11 = *((_QWORD *)Session + 123);
  }
  else
  {
    v7 = (_DWORD *)*(&WheapDeferredInternalLogsEventLock + 371);
    v8 = PoolTrackTableSize;
    v11 = PoolTrackTableExpansionSize;
    v10 = PoolTrackTableExpansion;
  }
  v12 = 0;
  if( v11 )
  {
    v13 = 0i64;
    do
    {
      v14 = v10[14 * v13];
      if( v14 == v4 )
        break;
      if( !v14 )
      {
        v10[14 * v12] = v4;
        break;
      }
      v13 = ++v12;
    }
    while( v12 < v11 );
  }
  if( v12 != v11 )
  {
    v15 = &v10[14 * v12];
    if( (PoolType & 1) != 0 )
    {
      ++v15[5];
      v15[4] += NumberOfBytes;
    }
    else
    {
      ++v15[2];
      v15[1] += NumberOfBytes;
    }
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    return;
  }
  if( v7[14 * v8 - 14] )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    v26 = (char *)&v7[14 * (unsigned int)(v8 - 1)];
    if( (PoolType & 1) != 0 )
    {
      v27 = 40i64;
    }
    else
    {
      v6 = 8i64;
      v27 = 16i64;
    }
    _InterlockedIncrement64((volatile signed __int64 *)&v26[v27]);
    _InterlockedExchangeAdd64((volatile signed __int64 *)&v26[v6], NumberOfBytes);
    return;
  }
  v32 = 56 * v11;
  Size = (56 * v11 + 4095) & 0xFFFFFFFFFFFFF000ui64;
  HeapPages = (char *)ExAllocateHeapPages();
  v17 = HeapPages;
  if( !HeapPages )
  {
    v30 = 14i64 * (unsigned int)(v8 - 1);
    v7[v30] = 1818654287;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    if( (PoolType & 1) != 0 )
    {
      _InterlockedIncrement64((volatile signed __int64 *)&v7[v30 + 10]);
      _InterlockedExchangeAdd64((volatile signed __int64 *)&v7[v30 + 8], NumberOfBytes);
    }
    else
    {
      _InterlockedIncrement64((volatile signed __int64 *)&v7[v30 + 4]);
      _InterlockedExchangeAdd64((volatile signed __int64 *)&v7[v30 + 2], NumberOfBytes);
    }
    return;
  }
  if( v10 )
    memmove(HeapPages, v10, Size);
  memset(&v17[v32], 0i64, Size + 4096 - v32);
  if( v39 )
  {
    v18 = KeGetCurrentThread()->ApcState.Process->Session;
    *((_QWORD *)v18 + 122) = v17;
    *((_QWORD *)v18 + 123) = (Size + 4096) / 0x38;
  }
  else
  {
    PoolTrackTableExpansion = v17;
    PoolTrackTableExpansionSize = (Size + 4096) / 0x38;
  }
  memset(&v36, 0, sizeof(v36));
  if( PoolHitTag == 1819242320 )
    __debugbreak();
  v28 = (unsigned int)*(&PerfGlobalGroupMask + 1);
  LODWORD(v28) = KeGetPcr()->Prcb.Number;
  v23 = PoolTrackTableMask;
  v25 = PoolTrackTableSize;
  v22 = PoolTrackTableMask & 0x40DEDA5;
  v33 = PoolTrackTableMask;
  v29 = *((_QWORD *)&WheapDeferredInternalLogsEventLock + v28 + 372);
  v24 = PoolTrackTableMask & 0x40DEDA5;
  v40 = PoolTrackTableMask & 0x40DEDA5;
  v34 = PoolTrackTableSize;
  do
  {
    while( 1 )
    {
      v19 = 56i64 * v22;
      v20 = *(_DWORD *)(v19 + v29);
      if( v20 == 1819242320 )
      {
        _InterlockedIncrement64((volatile signed __int64 *)(v19 + v29 + 16));
        _InterlockedExchangeAdd64((volatile signed __int64 *)(v19 + v29 + 8), Size + 4096);
        goto LABEL_25;
      }
      if( v20 )
        break;
      v21 = *(_DWORD *)(v19 + *(&WheapDeferredInternalLogsEventLock + 371));
      if( v21 )
      {
        *(_DWORD *)(v19 + v29) = v21;
      }
      else
      {
        if( v22 == v25 - 1 )
          break;
        KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&ExpTaggedPoolLock, &v36);
        if( !*(_DWORD *)(v19 + *(&WheapDeferredInternalLogsEventLock + 371)) )
        {
          *(_DWORD *)(v19 + *(&WheapDeferredInternalLogsEventLock + 371)) = 1819242320;
          *(_DWORD *)(v19 + v29) = 1819242320;
        }
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&v36);
        __writecr8(v36.OldIrql);
        v23 = v33;
        v24 = v40;
        v25 = v34;
      }
    }
    v22 = v23 & (v22 + 1);
  }
  while( v22 != v24 );
  ExpInsertPoolTrackerExpansion(0x6C6F6F50ui64, Size + 4096, NonPagedPoolNx);
LABEL_25:
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
  if( v10 )
    ExPoolCleanupExpansionTable(v10);
  ExpInsertPoolTrackerExpansion(Keya, NumberOfBytes, PoolType);
}

Referenced by: