RtlpHpSegMgrCommitComplete

INT16 __fastcall RtlpHpSegMgrCommitComplete(
        INT64 a1,
        volatile INT16 *a2,
        INT64 a3,
        INT64 a4,
        UINT64 SpinLock,
        UINT8 a6){
  INT16 result; 
  INT16 v9; 
  signed __int16 v10; 
  __int16 v11; 
  INT16 v12; 
  _ETHREAD *CurrentThread; 
  unsigned int SessionId; 
  char v15; 
  int v16; 
  bool v17; 
  __int64 v18; 
  unsigned __int64 v19; 
  __int64 v20; 
  unsigned int v21[14]; 
  result = *a2;
  while( 1 )
  {
    v9 = result;
    v10 = result;
    if( (result & 0x4000) != 0 )
    {
      if( (_DWORD)a4 && (int)a3 > 0 )
        v11 = 0x8000;
      else
        v11 = 0;
      v10 = v11 | result & 0x3FFF;
    }
    if( (int)a3 <= 0 )
    {
      v10 += a3;
    }
    else if( !(_DWORD)a4 )
    {
      v10 -= a3;
    }
    if( v10 == result )
      return result;
    v12 = result;
    result = _InterlockedCompareExchange16(a2, v10, result);
    if( v12 == result )
    {
      if( (v9 & 0x4000) != 0 )
      {
        if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
        {
          ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)SpinLock);
          result = KiIrqlFlags;
          __writecr8(a6);
        }
        else
        {
          if( (_InterlockedExchangeAdd64((volatile signed __int64 *)SpinLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
            ExfTryToWakePushLock((volatile INT64 *)SpinLock);
          v21[0] = 0;
          CurrentThread = (_ETHREAD *)KeGetCurrentThread();
          if( (unsigned int)MiGetSystemRegionType(SpinLock) == 1 )
            SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
          else
            SessionId = -1;
          --*((_WORD *)CurrentThread + 243);
          v15 = ++*((_BYTE *)CurrentThread + 794);
          v16 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
          while( 1 )
          {
            v17 = !_BitScanReverse((unsigned int *)&v18, v16);
            if( v17 )
              goto LABEL_25;
            v19 = *((_QWORD *)CurrentThread + 100) + 96 * v18;
            v16 &= ~(1 << v18);
            if( (*(_BYTE *)(v19 + 26) & 1) != 0
              && (*(_DWORD *)(v19 + 32) & 1) == 0
              && (*(_QWORD *)(v19 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (SpinLock & 0x7FFFFFFFFFFFFFFCi64)
              && *(_DWORD *)(v19 + 40) == SessionId )
            {
              *(_BYTE *)(v19 + 26) &= ~1u;
              if( *(_QWORD *)(v19 + 32) )
                break;
            }
          }
          if( !v19 )
          {
LABEL_25:
            if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
              KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, SpinLock, SessionId, 0i64);
            goto LABEL_37;
          }
          *(_BYTE *)(v19 + 32) |= 2u;
          if( *(__int64 *)(v19 + 32) < 0 )
            KiAbEntryRemoveFromTree(v19);
          v21[0] = *(_DWORD *)(v19 + 88) & 0x1FFFF;
          *(_DWORD *)(v19 + 88) &= 0xFFFE0000;
          *(_BYTE *)(v19 + 25) &= ~1u;
          *(_QWORD *)(v19 + 32) = 0i64;
          v20 = (__int64)(v19 - *((_QWORD *)CurrentThread + 100)) / 96;
          if( v15 == 1 )
            *((_BYTE *)CurrentThread + 792) |= 1 << v20;
          else
            _InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, 1 << v20);
LABEL_37:
          --*((_BYTE *)CurrentThread + 794);
          KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, SpinLock, v21);
          v17 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
          if( v17 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
            KiCheckForKernelApcDelivery();
          return KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
        }
      }
      return result;
    }
  }
}

Referenced by: