RtlpHpSegMgrVaCtxAlloc
UINT64 __stdcall RtlpHpSegMgrVaCtxAlloc(INT64 a1, INT64 a2, CHAR r8_0){
UINT64 v3;
_QWORD **v4;
UINT64 v8;
UINT8 v9;
_QWORD *v10;
unsigned __int64 v11;
unsigned int v12;
unsigned int v13;
int v14;
_RTL_RUN_ONCE v15;
_ETHREAD *v16;
unsigned int v17;
unsigned __int8 v18;
int v19;
bool v20;
__int64 v21;
_KLOCK_ENTRY *v22;
__int64 v23;
_ETHREAD *CurrentThread;
unsigned int SessionId;
unsigned __int8 v26;
int v27;
__int64 v28;
_KLOCK_ENTRY *v29;
unsigned __int8 v30;
UINT64 v31;
__int128 v32;
int v33;
UINT64 a3;
v33 = a2;
v3 = 0i64;
v4 = (_QWORD **)(a1 + 128);
HIDWORD(v31) = 0;
if( *(_OWORD *)(a1 + 120) != 0i64 )
{
v8 = a1 + 112;
v9 = RtlpHpAcquireLockExclusive((_EX_PUSH_LOCK *)(a1 + 112), *(_DWORD *)(a1 + 40) & 1);
v10 = *v4;
v11 = v9;
if( *v4 || (r8_0 & 2) == 0 && (--v4, (v10 = *v4) != 0i64) )
{
v12 = *((unsigned __int16 *)v10 - 3);
_BitScanForward(&v13, v12);
v14 = v12 ^ (1 << v13);
HIDWORD(v31) = v13;
*((_WORD *)v10 - 3) = v14;
if( !(_WORD)v14 )
{
if( *v4 )
*v4 = (_QWORD *)**v4;
*v10 = 0i64;
}
if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v8);
__writecr8(v11);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v8);
LODWORD(v31) = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v8) == 1 )
SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
else
SessionId = -1;
--CurrentThread->Tcb.SpecialApcDisable;
v26 = ++CurrentThread->Tcb.AbAllocationRegionCount;
v27 = ((char)CurrentThread->Tcb.AbEntrySummary | (char)CurrentThread->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v28, v27);
if( v20 )
goto LABEL_46;
v29 = &CurrentThread->Tcb.LockEntries[v28];
v27 &= ~(1 << v28);
if( (v29->AcquiredByte & 1) != 0
&& (v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v8 & 0x7FFFFFFFFFFFFFFCi64)
&& v29->LockState.SessionId == SessionId )
{
v29->AcquiredByte &= ~1u;
if( v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
}
if( !v29 )
{
LABEL_46:
if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, CurrentThread, (PVOID)v8, (PVOID)SessionId, 0i64);
goto LABEL_58;
}
v29->CrossThreadReleasableAndBusyByte |= 2u;
if( v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v29);
LODWORD(v31) = v29->BoostBitmap.AllFields & 0x1FFFF;
v29->BoostBitmap.AllFields &= 0xFFFE0000;
v29->ThreadLocalFlags &= ~1u;
v29->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v30 = 1 << (v29 - CurrentThread->Tcb.LockEntries);
if( v26 == 1 )
CurrentThread->Tcb.AbEntrySummary |= v30;
else
_InterlockedOr8((volatile signed __int8 *)&CurrentThread->Tcb.AbOrphanedEntrySummary, v30);
LABEL_58:
--CurrentThread->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)v8, &v31);
v20 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v20
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
v32 = *(_OWORD *)(a1 + 40);
v15.Ptr = (void *)RtlpHpEnvGetHeapManager(&v32)[6 * *((unsigned __int8 *)v10 - 15) + 284];
return(((unsigned __int64)v10 - *(_QWORD *)(v15.Value + 40) - 16) >> *(_DWORD *)(v15.Value + 24) << 20)
+ *(_QWORD *)(v15.Value + 8)
+ (unsigned int)(v33 * HIDWORD(v31));
}
else if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v8);
__writecr8(v11);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v8);
LODWORD(a3) = 0;
v16 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v8) == 1 )
v17 = MmGetSessionIdEx(v16->Tcb.ApcState.Process);
else
v17 = -1;
--v16->Tcb.SpecialApcDisable;
v18 = ++v16->Tcb.AbAllocationRegionCount;
v19 = ((char)v16->Tcb.AbEntrySummary | (char)v16->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v20 = !_BitScanReverse((unsigned int *)&v21, v19);
if( v20 )
goto LABEL_21;
v22 = &v16->Tcb.LockEntries[v21];
v19 &= ~(1 << v21);
if( (v22->AcquiredByte & 1) != 0
&& (v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v8 & 0x7FFFFFFFFFFFFFFCi64)
&& v22->LockState.SessionId == v17 )
{
v22->AcquiredByte &= ~1u;
if( v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
}
if( !v22 )
{
LABEL_21:
if( (*(&v16->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v16, (PVOID)v8, (PVOID)v17, 0i64);
goto LABEL_33;
}
v22->CrossThreadReleasableAndBusyByte |= 2u;
if( v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v22);
LODWORD(a3) = v22->BoostBitmap.AllFields & 0x1FFFF;
v22->BoostBitmap.AllFields &= 0xFFFE0000;
v22->ThreadLocalFlags &= ~1u;
v22->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v23 = v22 - v16->Tcb.LockEntries;
if( v18 == 1 )
v16->Tcb.AbEntrySummary |= 1 << v23;
else
_InterlockedOr8((volatile signed __int8 *)&v16->Tcb.AbOrphanedEntrySummary, 1 << v23);
LABEL_33:
--v16->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v16->Tcb, (VOID *)v8, &a3);
v20 = v16->Tcb.SpecialApcDisable++ == -1;
if( v20 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v16->Tcb.ApcState.ApcListHead[0].Flink != &v16->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
}
return v3;
}Referenced by:
RtlpHpSegMgrReserve