ExpSaPageGroupDescriptorFree

INT64 __stdcall ExpSaPageGroupDescriptorFree(PVOID BugCheckParameter2, DOUBLE a2){
  unsigned int MaximumProcessorCount; 
  _ETHREAD *CurrentThread; 
  __int64 v5; 
  unsigned __int8 v6; 
  unsigned int v7; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  int SessionId; 
  bool v12; 
  __int64 v13; 
  UINT64 v14; 
  unsigned int v15; 
  INT64 v16; 
  int v17; 
  __int64 v18; 
  void *v19; 
  _ETHREAD *v20; 
  char v21; 
  int v22; 
  unsigned __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  INT64 result; 
  unsigned int v27[4]; 
  int v28; 
  int v29; 
  MaximumProcessorCount = KeQueryMaximumProcessorCountEx(0xFFFFu);
  v27[0] = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = MaximumProcessorCount;
  --*((_WORD *)CurrentThread + 243);
  if( ++*((_BYTE *)CurrentThread + 794) != 1 )
    KeBugCheckEx(
      0x192u,
      (ULONG_PTR)CurrentThread,
      (ULONG_PTR)&ExSaPageGroupDescriptorArrayLock,
      KeGetCurrentIrql(),
      0i64);
  v29 = 0;
  v6 = *((_BYTE *)CurrentThread + 792);
  v7 = -1;
  if( !v6 )
  {
    if( !*((_BYTE *)CurrentThread + 870) )
    {
      v10 = 0i64;
      goto LABEL_7;
    }
    v8 = *((unsigned __int8 *)CurrentThread + 870);
    *((_BYTE *)CurrentThread + 870) = 0;
    v6 = v8 | *((_BYTE *)CurrentThread + 792);
  }
  _BitScanForward((unsigned int *)&v9, v6);
  v29 = v9;
  *((_BYTE *)CurrentThread + 792) = v6 & ~(1 << v9);
  v10 = *((_QWORD *)CurrentThread + 100) + 96 * v9;
  if( v10 )
  {
    if( (unsigned __int64)&ExSaPageGroupDescriptorArrayLock >= 0xFFFF800000000000ui64
      && *((_BYTE *)&antNameB + (((unsigned __int64)&ExSaPageGroupDescriptorArrayLock >> 39) & 0x1FF) - 256) == 1 )
    {
      SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
    }
    else
    {
      SessionId = -1;
    }
    *(_DWORD *)(v10 + 40) = SessionId;
    *(_QWORD *)(v10 + 32) = (unsigned __int64)&ExSaPageGroupDescriptorArrayLock & 0x7FFFFFFFFFFFFFFCi64;
    goto LABEL_14;
  }
LABEL_7:
  _interlockedbittestandset((volatile signed __int32 *)CurrentThread + 30, 0x10u);
LABEL_14:
  --*((_BYTE *)CurrentThread + 794);
  KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, (__int64)&ExSaPageGroupDescriptorArrayLock, v27);
  v12 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
  if( v12 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
    KiCheckForKernelApcDelivery();
  if( _interlockedbittestandset64((volatile signed __int32 *)&ExSaPageGroupDescriptorArrayLock, 0i64) )
    ExfAcquirePushLockExclusiveEx(&ExSaPageGroupDescriptorArrayLock, (VOID *)v10, &ExSaPageGroupDescriptorArrayLock);
  if( v10 )
    *(_BYTE *)(v10 + 26) |= 1u;
  if( (_DWORD)v5 )
  {
    v13 = 0i64;
    do
    {
      v14 = *((unsigned int *)BugCheckParameter2 + 8);
      _BitScanReverse(&v15, v14);
      v16 = *(_QWORD *)(v13 + ExSaPageArrays);
      v17 = 1 << v15;
      v18 = v15 - 2;
      v27[1] = v18;
      v19 = *(void **)(*(_QWORD *)(v16 + 8 * v18) + 8i64 * ((unsigned int)v14 ^ v17) + 8);
      ExpSaBinaryArrayRemove(v16, v14);
      ExFreeHeapPool(v19);
      v13 += 8i64;
      --v5;
    }
    while( v5 );
    v7 = -1;
  }
  ExpSaBinaryArrayRemove(ExSaPageGroupDescriptorArray, *((unsigned int *)BugCheckParameter2 + 8));
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&ExSaPageGroupDescriptorArrayLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&ExSaPageGroupDescriptorArrayLock);
  v28 = 0;
  v20 = (_ETHREAD *)KeGetCurrentThread();
  if( (unsigned int)MiGetSystemRegionType((UINT64)&ExSaPageGroupDescriptorArrayLock) == 1 )
    v7 = MmGetSessionIdEx(*((_QWORD *)v20 + 23));
  --*((_WORD *)v20 + 243);
  v21 = ++*((_BYTE *)v20 + 794);
  v22 = (*((char *)v20 + 792) | *((char *)v20 + 870)) ^ 0x3F;
  while( 1 )
  {
    v12 = !_BitScanReverse((unsigned int *)&v24, v22);
    if( v12 )
      goto LABEL_36;
    v23 = *((_QWORD *)v20 + 100) + 96 * v24;
    v22 &= ~(1 << v24);
    if( (*(_BYTE *)(v23 + 26) & 1) != 0
      && (*(_DWORD *)(v23 + 32) & 1) == 0
      && (*(_QWORD *)(v23 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&ExSaPageGroupDescriptorArrayLock & 0x7FFFFFFFFFFFFFFCi64)
      && *(_DWORD *)(v23 + 40) == v7 )
    {
      *(_BYTE *)(v23 + 26) &= ~1u;
      if( *(_QWORD *)(v23 + 32) )
        break;
    }
  }
  if( !v23 )
  {
LABEL_36:
    if( (*((_DWORD *)v20 + 30) & 0x10000) == 0 )
      KeBugCheckEx(0x162u, (ULONG_PTR)v20, (ULONG_PTR)&ExSaPageGroupDescriptorArrayLock, v7, 0i64);
    goto LABEL_43;
  }
  *(_BYTE *)(v23 + 32) |= 2u;
  if( *(__int64 *)(v23 + 32) < 0 )
    KiAbEntryRemoveFromTree(v23);
  v28 = *(_DWORD *)(v23 + 88) & 0x1FFFF;
  *(_DWORD *)(v23 + 88) &= 0xFFFE0000;
  *(_BYTE *)(v23 + 25) &= ~1u;
  *(_QWORD *)(v23 + 32) = 0i64;
  v25 = (__int64)(v23 - *((_QWORD *)v20 + 100)) / 96;
  if( v21 == 1 )
    *((_BYTE *)v20 + 792) |= 1 << v25;
  else
    _InterlockedOr8((volatile signed __int8 *)v20 + 870, 1 << v25);
LABEL_43:
  --*((_BYTE *)v20 + 794);
  KiAbThreadRemoveBoosts((ULONG_PTR)v20, (__int64)&ExSaPageGroupDescriptorArrayLock, (unsigned int *)&v28);
  v12 = (*((_WORD *)v20 + 243))++ == 0xFFFF;
  if( v12 && *((_ETHREAD **)v20 + 19) != (_ETHREAD *)((char *)v20 + 152) )
    KiCheckForKernelApcDelivery();
  LODWORD(result) = ExFreeHeapPool(BugCheckParameter2);
  return result;
}

Referenced by: