RtlpHpSegMgrVaCtxAlloc

UINT64 __fastcall RtlpHpSegMgrVaCtxAlloc(INT64 rcx0, INT64 a2, CHAR a3){
  UINT64 v3; 
  _QWORD **v4; 
  INT64 v8; 
  UINT8 v9; 
  _QWORD *v10; 
  unsigned __int64 v11; 
  unsigned int v12; 
  unsigned int v13; 
  int v14; 
  union _RTL_RUN_ONCE v15; 
  _ETHREAD *v16; 
  unsigned int v17; 
  char v18; 
  int v19; 
  bool v20; 
  __int64 v21; 
  unsigned __int64 v22; 
  __int64 v23; 
  _ETHREAD *CurrentThread; 
  unsigned int SessionId; 
  char v26; 
  int v27; 
  __int64 v28; 
  unsigned __int64 v29; 
  unsigned __int8 v30; 
  int v31; 
  unsigned int v32; 
  _DWORD a1[4]; 
  int v34; 
  int v35; 
  v34 = a2;
  v3 = 0i64;
  v4 = (_QWORD **)(rcx0 + 128);
  v32 = 0;
  if( *(_OWORD *)(rcx0 + 120) != 0i64 )
  {
    v8 = rcx0 + 112;
    v9 = RtlpHpAcquireLockExclusive((INT64 *)(rcx0 + 112), *(_DWORD *)(rcx0 + 40) & 1);
    v10 = *v4;
    v11 = v9;
    if( *v4 || (a3 & 2) == 0 && (--v4, (v10 = *v4) != 0i64) )
    {
      v12 = *((unsigned __int16 *)v10 - 3);
      _BitScanForward(&v13, v12);
      v14 = v12 ^ (1 << v13);
      v32 = v13;
      *((_WORD *)v10 - 3) = v14;
      if( !(_WORD)v14 )
      {
        if( *v4 )
          *v4 = (_QWORD *)**v4;
        *v10 = 0i64;
      }
      if( (*(_DWORD *)(rcx0 + 40) & 1) != 0 )
      {
        ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v8);
        __writecr8(v11);
      }
      else
      {
        if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((volatile INT64 *)v8);
        v31 = 0;
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        if( (unsigned int)MiGetSystemRegionType(v8) == 1 )
          SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
        else
          SessionId = -1;
        --*((_WORD *)CurrentThread + 243);
        v26 = ++*((_BYTE *)CurrentThread + 794);
        v27 = (*((char *)CurrentThread + 792) | *((char *)CurrentThread + 870)) ^ 0x3F;
        while( 1 )
        {
          v20 = !_BitScanReverse((unsigned int *)&v28, v27);
          if( v20 )
            goto LABEL_46;
          v29 = *((_QWORD *)CurrentThread + 100) + 96 * v28;
          v27 &= ~(1 << v28);
          if( (*(_BYTE *)(v29 + 26) & 1) != 0
            && (*(_DWORD *)(v29 + 32) & 1) == 0
            && (*(_QWORD *)(v29 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v8 & 0x7FFFFFFFFFFFFFFCi64)
            && *(_DWORD *)(v29 + 40) == SessionId )
          {
            *(_BYTE *)(v29 + 26) &= ~1u;
            if( *(_QWORD *)(v29 + 32) )
              break;
          }
        }
        if( !v29 )
        {
LABEL_46:
          if( (*((_DWORD *)CurrentThread + 30) & 0x10000) == 0 )
            KeBugCheckEx(0x162u, (ULONG_PTR)CurrentThread, v8, SessionId, 0i64);
          goto LABEL_58;
        }
        *(_BYTE *)(v29 + 32) |= 2u;
        if( *(__int64 *)(v29 + 32) < 0 )
          KiAbEntryRemoveFromTree(v29);
        v31 = *(_DWORD *)(v29 + 88) & 0x1FFFF;
        *(_DWORD *)(v29 + 88) &= 0xFFFE0000;
        *(_BYTE *)(v29 + 25) &= ~1u;
        *(_QWORD *)(v29 + 32) = 0i64;
        v30 = 1 << ((__int64)(v29 - *((_QWORD *)CurrentThread + 100)) / 96);
        if( v26 == 1 )
          *((_BYTE *)CurrentThread + 792) |= v30;
        else
          _InterlockedOr8((volatile signed __int8 *)CurrentThread + 870, v30);
LABEL_58:
        --*((_BYTE *)CurrentThread + 794);
        KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, v8, (unsigned int *)&v31);
        v20 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
        if( v20 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
          KiCheckForKernelApcDelivery();
        KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
      }
      *(_OWORD *)a1 = *(_OWORD *)(rcx0 + 40);
      v15.Ptr = (void *)RtlpHpEnvGetHeapManager(a1)[6 * *((unsigned __int8 *)v10 - 15) + 284];
      return(((unsigned __int64)v10 - *(_QWORD *)(v15.Value + 40) - 16) >> *(_DWORD *)(v15.Value + 24) << 20)
           + *(_QWORD *)(v15.Value + 8)
           + v34 * v32;
    }
    else if( (*(_DWORD *)(rcx0 + 40) & 1) != 0 )
    {
      ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)v8);
      __writecr8(v11);
    }
    else
    {
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)v8);
      v35 = 0;
      v16 = (_ETHREAD *)KeGetCurrentThread();
      if( (unsigned int)MiGetSystemRegionType(v8) == 1 )
        v17 = MmGetSessionIdEx(*((_QWORD *)v16 + 23));
      else
        v17 = -1;
      --*((_WORD *)v16 + 243);
      v18 = ++*((_BYTE *)v16 + 794);
      v19 = (*((char *)v16 + 792) | *((char *)v16 + 870)) ^ 0x3F;
      while( 1 )
      {
        v20 = !_BitScanReverse((unsigned int *)&v21, v19);
        if( v20 )
          goto LABEL_21;
        v22 = *((_QWORD *)v16 + 100) + 96 * v21;
        v19 &= ~(1 << v21);
        if( (*(_BYTE *)(v22 + 26) & 1) != 0
          && (*(_DWORD *)(v22 + 32) & 1) == 0
          && (*(_QWORD *)(v22 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v8 & 0x7FFFFFFFFFFFFFFCi64)
          && *(_DWORD *)(v22 + 40) == v17 )
        {
          *(_BYTE *)(v22 + 26) &= ~1u;
          if( *(_QWORD *)(v22 + 32) )
            break;
        }
      }
      if( !v22 )
      {
LABEL_21:
        if( (*((_DWORD *)v16 + 30) & 0x10000) == 0 )
          KeBugCheckEx(0x162u, (ULONG_PTR)v16, v8, v17, 0i64);
        goto LABEL_33;
      }
      *(_BYTE *)(v22 + 32) |= 2u;
      if( *(__int64 *)(v22 + 32) < 0 )
        KiAbEntryRemoveFromTree(v22);
      v35 = *(_DWORD *)(v22 + 88) & 0x1FFFF;
      *(_DWORD *)(v22 + 88) &= 0xFFFE0000;
      *(_BYTE *)(v22 + 25) &= ~1u;
      *(_QWORD *)(v22 + 32) = 0i64;
      v23 = (__int64)(v22 - *((_QWORD *)v16 + 100)) / 96;
      if( v18 == 1 )
        *((_BYTE *)v16 + 792) |= 1 << v23;
      else
        _InterlockedOr8((volatile signed __int8 *)v16 + 870, 1 << v23);
LABEL_33:
      --*((_BYTE *)v16 + 794);
      KiAbThreadRemoveBoosts((ULONG_PTR)v16, v8, (unsigned int *)&v35);
      v20 = (*((_WORD *)v16 + 243))++ == 0xFFFF;
      if( v20 && *((_ETHREAD **)v16 + 19) != (_ETHREAD *)((char *)v16 + 152) )
        KiCheckForKernelApcDelivery();
      KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    }
  }
  return v3;
}

Referenced by: