RtlpHpLargeAllocSetExtraPresent
UINT64 __stdcall RtlpHpLargeAllocSetExtraPresent(PVOID Va, UINT8 WsIrql){
char v2;
UINT64 v3;
char v4;
UINT64 result;
unsigned __int64 v7;
unsigned __int64 v8;
v3 = WsIrql;
v4 = v2;
LOBYTE(result) = RtlpHpLargeLockAcquireShared((__int64)Va, v2);
v7 = (unsigned __int8)result;
v8 = *((_QWORD *)Va + 9);
if( (*((_BYTE *)Va + 80) & 1) != 0 )
{
if( v8 )
v8 ^= (unsigned __int64)Va + 72;
else
v8 = 0i64;
}
while( v8 )
{
result = *(_QWORD *)(v8 + 24) & 0xFFFFFFFFFFFF0000ui64;
if( v3 < result )
{
result = *(_QWORD *)v8;
}
else
{
if( v3 <= result )
goto LABEL_16;
result = *(_QWORD *)(v8 + 8);
}
if( (*((_BYTE *)Va + 80) & 1) != 0 && result )
v8 ^= result;
else
v8 = result;
}
v8 = 0i64;
LABEL_16:
if( (v4 & 1) == 0 )
{
if( (*(_DWORD *)Va & 1) != 0 )
{
ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)Va + 16);
result = (unsigned int)KiIrqlFlags;
__writecr8(v7);
}
else
{
if( _InterlockedCompareExchange64((volatile signed __int64 *)Va + 8, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)Va + 8);
KeAbPostRelease((char *)Va + 64);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
}
*(_QWORD *)(v8 + 32) |= 1ui64;
return result;
}Referenced by:
RtlpHpExtrasSetPresent