RtlpStdExtendLowerWatermark
VOID *__stdcall RtlpStdExtendLowerWatermark(_STACK_TRACE_DATABASE *Database, UINT64 Size){
VOID *v4;
char *v5;
char v6;
VOID *v7;
unsigned __int64 v8;
unsigned __int64 v9;
UINT64 AllocationType;
UINT64 Protect;
UINT64 RegionSize;
VOID *BaseAddress;
RegionSize = 0i64;
v4 = 0i64;
*((_BYTE *)Database + 8) = KeAcquireSpinLockRaiseToDpc((UINT64 *)Database);
v5 = (char *)*((_QWORD *)Database + 20);
v6 = *((_BYTE *)Database + 128);
v7 = (VOID *)*((_QWORD *)Database + 18);
BaseAddress = v7;
v8 = (unsigned __int64)&v5[Size];
if( !v6 )
{
if( v8 > (unsigned __int64)v7 )
{
RegionSize = (Size + 4095) & 0xFFFFFFFFFFFFF000ui64;
if( (unsigned __int64)v7 + RegionSize >= *((_QWORD *)Database + 19) )
goto LABEL_9;
LODWORD(Protect) = 4;
LODWORD(AllocationType) = 4096;
if( ZwAllocateVirtualMemory(
(VOID *)0xFFFFFFFFFFFFFFFFi64,
&BaseAddress,
0i64,
&RegionSize,
AllocationType,
Protect) < 0 )
goto LABEL_9;
*((_QWORD *)Database + 18) = (char *)BaseAddress + RegionSize;
}
LABEL_8:
++Database[48];
*((_QWORD *)Database + 20) = &v5[Size];
v4 = v5;
goto LABEL_9;
}
if( v8 <= *((_QWORD *)Database + 21) )
goto LABEL_8;
LABEL_9:
v9 = *((unsigned __int8 *)Database + 8);
KxReleaseSpinLock((UINT64 *)Database);
__writecr8(v9);
return v4;
}Referenced by:
RtlpStdGetSpaceForTrace