WbAllocateUserMemory

_IRP *__stdcall WbAllocateUserMemory(
        UINT64 MajorFunction,
        _DEVICE_OBJECT *DeviceObject,
        VOID *Buffer,
        UINT64 Length,
        _LARGE_INTEGER *StartingOffset,
        _KEVENT *Event,
        _IO_STATUS_BLOCK *IoStatusBlock){
  int v7; 
  PVOID *v9; 
  PVOID *v10; 
  int v11; 
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *v13; 
  _BYTE *v14; 
  int v15; 
  VOID *v16; 
  VOID *v17; 
  _MDL *v18; 
  _ETHREAD *v20; 
  _BYTE *v21; 
  INT64 v22; 
  _BYTE *v23; 
  char v24; 
  UINT64 v25; 
  UINT64 v26; 
  PVOID *BaseAddress; 
  _MDL *Mdl[3]; 

  v7 = (int)DeviceObject;
  BaseAddress = 0i64;
  Mdl[0] = 0i64;
  v9 = 0i64;
  v10 = 0i64;
  v11 = 0;
  if( (unsigned int)DeviceObject > 0x10000 )
  {
    v11 = -1073741811;
    goto LABEL_17;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.SpecialApcDisable;
  v13 = (_EX_PUSH_LOCK *)(MajorFunction + 224);
  v14 = KeAbPreAcquire((VOID *)(MajorFunction + 224), 0i64, 0i64);
  if( _InterlockedCompareExchange64(&v13->_bf_0, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(v13, v14, v13);
  if( v14 )
    v14[26] |= 1u;
  v15 = 0;
  if( *(_DWORD *)(MajorFunction + 188) )
  {
    while( 1 )
    {
      v9 = *(PVOID **)((unsigned int)(v15 * *(_DWORD *)(MajorFunction + 184)) + *(_QWORD *)(MajorFunction + 200));
      v11 = sub_14065FACC((INT64)v9, v7, (INT64 *)Mdl);
      if( v11 < 0 )
        goto LABEL_29;
      if( !Mdl[0] && (unsigned int)++v15 < *(_DWORD *)(MajorFunction + 188) )
        continue;
      break;
    }
  }
  if( _InterlockedCompareExchange64(&v13->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(v13);
  KeAbPostRelease(v13);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  v18 = Mdl[0];
  if( Mdl[0] )
  {
    v10 = BaseAddress;
  }
  else
  {
    v11 = WbAllocateMemoryBlock(0i64, &BaseAddress, v16, v17, v25);
    if( v11 < 0 )
      goto LABEL_29;
    v10 = BaseAddress;
    v11 = sub_14065FACC((INT64)BaseAddress, v7, (INT64 *)Mdl);
    if( v11 < 0 )
      goto LABEL_17;
    v20 = (_ETHREAD *)KeGetCurrentThread();
    --v20->Tcb.SpecialApcDisable;
    v21 = KeAbPreAcquire(v13, 0i64, 0i64);
    v23 = v21;
    if( _interlockedbittestandset64((volatile signed __int32 *)v13, 0i64) )
      ExfAcquirePushLockExclusiveEx(v13, v21, v13);
    if( v23 )
      v23[26] |= 1u;
    LODWORD(v26) = -1;
    v11 = sub_14065FDF0((INT64 *)(MajorFunction + 184), (INT64)BaseAddress, v22, (__int64)BaseAddress[4], 8, v26);
    v24 = _InterlockedExchangeAdd64(&v13->_bf_0, 0xFFFFFFFFFFFFFFFFui64);
    if( (v24 & 2) != 0 && (v24 & 4) == 0 )
      ExfTryToWakePushLock(v13);
    KeAbPostRelease(v13);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    if( v11 < 0 )
    {
LABEL_29:
      v10 = BaseAddress;
      goto LABEL_17;
    }
    v9 = BaseAddress;
    v10 = 0i64;
    v18 = Mdl[0];
  }
  if( Buffer )
    *(_QWORD *)Buffer = v18;
  if( Length )
    *(_QWORD *)Length = (char *)v18 + (_BYTE *)*v9 - (_BYTE *)v9[4];
LABEL_17:
  WbFreeMemoryBlock(v10);
  return(_IRP *)(unsigned int)v11;
}

Referenced by: