RtlpExtendHeap

INT64 __fastcall RtlpExtendHeap(INT64 a1, INT64 a2){
  _HEAP_FREE_ENTRY *v4; 
  UINT64 *v5; 
  _HEAP_FREE_ENTRY *v6; 
  unsigned __int64 v7; 
  ULONG_PTR v8; 
  INT64 v9; 
  unsigned __int64 v10; 
  NTSTATUS v11; 
  ULONG_PTR v12; 
  INT64 v13; 
  INT64 v14; 
  INT64 v15; 
  NTSTATUS v16; 
  UINT64 v17; 
  UINT64 *AllocationType; 
  UINT64 AllocationTypea; 
  INT64 AllocationTypeb; 
  VOID *Protect; 
  UINT64 Protecta; 
  __int64 v24[2]; 
  ULONG_PTR RegionSize; 
  PVOID BaseAddress; 
  UINT64 FreeSize; 
  FreeSize = ((_DWORD)a2 + 4095) & 0xFFFFF000;
  v4 = (_HEAP_FREE_ENTRY *)RtlpFindAndCommitPages(a1, &FreeSize);
  if( v4 )
  {
    FreeSize >>= 4;
    v6 = RtlpCoalesceFreeBlocks((_HEAP *)a1, v4, &FreeSize, v5, AllocationType, Protect);
    RtlpInsertFreeBlock(a1, (UINT64)v6, FreeSize);
    if( *(_DWORD *)(a1 + 124) )
    {
      v6->HeapEntry.UnpackedEntry.SubSegmentCode ^= *(_DWORD *)(a1 + 136);
      if( v6->HeapEntry.UnpackedEntry.SmallTagIndex != (LOBYTE(v6->InterceptorValue) ^ (unsigned __int8)(BYTE1(v6->Code1) ^ v6->HeapEntry.UnpackedEntry.Flags)) )
        RtlpAnalyzeHeapFailure(a1, (UINT64)v6);
    }
    return(INT64)v6;
  }
  if( (*(_DWORD *)(a1 + 112) & 2) == 0 )
    return 0i64;
  v7 = *(_QWORD *)(a1 + 160);
  v8 = a2 + 0x2000;
  BaseAddress = 0i64;
  LODWORD(Protect) = 4;
  v9 = a2 + 0x2000;
  LODWORD(AllocationType) = 0x2000;
  if( a2 + 0x2000 <= v7 )
    v9 = v7;
  v10 = (v9 + 0xFFFF) & 0xFFFFFFFFFFFF0000ui64;
  if( v10 >= 0xFD0000 )
    v10 = 16580608i64;
  RegionSize = v10;
  v11 = ZwAllocateVirtualMemory(
          (PVOID)0xFFFFFFFFFFFFFFFFi64,
          &BaseAddress,
          0i64,
          &RegionSize,
          (UINT64)AllocationType,
          (UINT64)Protect);
  if( v11 >= 0 )
  {
    v12 = RegionSize;
  }
  else
  {
    while( 1 )
    {
      v12 = RegionSize;
      if( RegionSize == v8 )
        break;
      v13 = RegionSize >> 1;
      LODWORD(Protecta) = 4;
      LODWORD(AllocationTypea) = 0x2000;
      if( RegionSize >> 1 < v8 )
        v13 = a2 + 0x2000;
      RegionSize = v13;
      v11 = ZwAllocateVirtualMemory(
              (PVOID)0xFFFFFFFFFFFFFFFFi64,
              &BaseAddress,
              0i64,
              &RegionSize,
              AllocationTypea,
              Protecta);
      if( v11 >= 0 )
      {
        v12 = RegionSize;
        break;
      }
    }
    if( v11 < 0 )
    {
      ++*(_DWORD *)(a1 + 632);
      return 0i64;
    }
  }
  *(_QWORD *)(a1 + 160) += v12;
  v14 = a2 + 4096;
  if( (unsigned __int64)(a2 + 4096) <= *(_QWORD *)(a1 + 168) )
    v14 = *(_QWORD *)(a1 + 168);
  v15 = *(_QWORD *)(a1 + 576) - *(_QWORD *)(a1 + 664);
  v24[0] = (v14 + 4095) & 0xFFFFFFFFFFFFF000ui64;
  if( !(unsigned int)RtlpHpHeapCheckCommitLimit(v24[0], v15, a1, (UINT64 *)(a1 + 376)) )
    goto LABEL_30;
  LODWORD(Protecta) = 4;
  LODWORD(AllocationTypea) = 4096;
  v16 = ZwAllocateVirtualMemory(
          (PVOID)0xFFFFFFFFFFFFFFFFi64,
          &BaseAddress,
          0i64,
          (UINT64 *)v24,
          AllocationTypea,
          Protecta);
  if( v16 < 0 )
    goto LABEL_30;
  LODWORD(AllocationTypeb) = 2;
  if( !RtlpInitializeHeapSegment(
          a1,
          (INT64)BaseAddress,
          112i64,
          (INT64)BaseAddress + RegionSize - 4096,
          AllocationTypeb,
          (INT64)BaseAddress,
          (UINT64)BaseAddress + v24[0],
          (UINT64)BaseAddress + RegionSize - 4096) )
    v16 = -1073741801;
  if( v16 < 0 )
  {
LABEL_30:
    ZwFreeVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, &BaseAddress, &RegionSize, 0x8000ui64);
    return 0i64;
  }
  v17 = *((_QWORD *)BaseAddress + 8);
  if( *(_DWORD *)(a1 + 124) )
  {
    *(_DWORD *)(v17 + 8) ^= *(_DWORD *)(a1 + 136);
    if( *(_BYTE *)(v17 + 11) != (*(_BYTE *)(v17 + 8) ^ (unsigned __int8)(*(_BYTE *)(v17 + 9) ^ *(_BYTE *)(v17 + 10))) )
      RtlpAnalyzeHeapFailure(a1, v17);
  }
  return *((_QWORD *)BaseAddress + 8);
}

Referenced by: