MiInsertSharedCommitNode

NTSTATUS __stdcall MiInsertSharedCommitNode(_RTL_BALANCED_NODE *ControlArea, _EPROCESS *JobProcess, UINT64 Flags){
  int v3; 
  __int64 v6; 
  int inserted; 
  _EPROCESS *v8; 
  _EX_PUSH_LOCK *v9; 
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *v11; 
  _QWORD *bf_0; 
  BOOL v13; 
  int v14; 
  _QWORD *PoolMm; 
  __int64 CommittedPages; 
  _RTL_BALANCED_NODE *v17; 
  _LIST_ENTRY *Blink; 
  _LIST_ENTRY *v19; 
  volatile signed __int64 *p_SharedCommitCharge; 
  _QWORD *v22; 
  UINT64 v23; 
  unsigned __int64 v24; 
  _EX_PUSH_LOCK *v25; 
  _RTL_BALANCED_NODE **Tree; 

  v3 = Flags;
  if( !MiIncludeSharedCommit((_CONTROL_AREA *)ControlArea) || (*(_DWORD *)(v6 + 56) & 0x20) != 0 )
    return 0;
  inserted = 0;
  if( ((unsigned __int8)JobProcess & 1) == 0 )
  {
    v8 = JobProcess;
    if( (JobProcess->Flags3 & 0x10) == 0 )
    {
      v24 = 0i64;
      v23 = 64i64;
      goto LABEL_6;
    }
    return 0;
  }
  v23 = 40i64;
  v8 = 0i64;
  v24 = (unsigned __int64)JobProcess & 0xFFFFFFFFFFFFFFFEui64;
LABEL_6:
  v9 = *(_EX_PUSH_LOCK **)v6;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v11 = v9 + 9;
  Tree = (_RTL_BALANCED_NODE **)&v9[9];
  v25 = v9;
  if( (v3 & 1) == 0 )
  {
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx(&v8->SharedCommitLock, 0i64);
    v9 = v25;
  }
  if( (v3 & 2) == 0 )
  {
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx(v9 + 5, 0i64);
  }
  bf_0 = (_QWORD *)v11->_bf_0;
  v13 = 0;
  if( !bf_0 )
    goto LABEL_11;
  while( (unsigned __int64)JobProcess <= bf_0[3] )
  {
    if( (unsigned __int64)JobProcess >= bf_0[3] )
    {
      ++bf_0[4];
      goto LABEL_21;
    }
    v22 = (_QWORD *)*bf_0;
    if( !*bf_0 )
      goto LABEL_11;
LABEL_32:
    bf_0 = v22;
  }
  v22 = (_QWORD *)bf_0[1];
  if( v22 )
    goto LABEL_32;
  v13 = 1;
LABEL_11:
  LOWORD(v14) = MmGetCurrentProcessorColor();
  PoolMm = ExAllocatePoolMm(256i64, v23, 0x6E53694Dui64, v14 | 0x80000000);
  if( PoolMm )
  {
    PoolMm[4] = 1i64;
    PoolMm[3] = JobProcess;
    CommittedPages = MiGetCommittedPages(ControlArea);
    if( v8 )
    {
      v17[2].Children[1] = ControlArea;
      Blink = v8->SharedCommitLinks.Blink;
      v19 = (_LIST_ENTRY *)&v17[1].16;
      if( Blink->Flink != &v8->SharedCommitLinks )
        __fastfail(3u);
      v19->Flink = &v8->SharedCommitLinks;
      v17[2].Children[0] = (_RTL_BALANCED_NODE *)Blink;
      Blink->Flink = v19;
      v8->SharedCommitLinks.Blink = v19;
      p_SharedCommitCharge = (volatile signed __int64 *)&v8->SharedCommitCharge;
    }
    else
    {
      p_SharedCommitCharge = (volatile signed __int64 *)(v24 + 1336);
    }
    _InterlockedExchangeAdd64(p_SharedCommitCharge, CommittedPages);
    RtlAvlInsertNodeEx(Tree, (UINT64)bf_0, v13, v17);
    if( v8 )
    {
      if( (v8->Flags3 & 8) != 0 )
      {
        inserted = MiInsertSharedCommitNode(ControlArea, (_EPROCESS *)((__int64)v8->Job | 1), 3ui64);
        if( inserted < 0 )
          MiRemoveSharedCommitNode((_CONTROL_AREA *)ControlArea, v8, v3 | 7u);
      }
    }
  }
  else
  {
    inserted = -1073741670;
  }
LABEL_21:
  if( (v3 & 2) == 0 )
  {
    if( (_InterlockedExchangeAdd64(&v25[5]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v25 + 5);
    KeAbPostRelease(&v25[5]);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
  if( (v3 & 1) == 0 )
  {
    if( (_InterlockedExchangeAdd64(&v8->SharedCommitLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&v8->SharedCommitLock);
    KeAbPostRelease(&v8->SharedCommitLock);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
  return inserted;
}

Referenced by: