RtlpCreateSplitBlock
CHAR __fastcall RtlpCreateSplitBlock(INT64 a1, INT64 a2, UINT64 a3, CHAR a4, CHAR a5, INT16 a6, INT64 a7){
int v7;
INT64 v10;
UINT64 v11;
__int16 v13;
UINT64 v14;
INT64 *v15;
INT64 v16;
INT64 v17;
INT64 v18;
INT64 v19;
unsigned __int64 v20;
unsigned __int64 i;
INT64 v22;
int v23;
char v24;
SIZE_T v25;
SIZE_T v26;
UINT64 v27;
__int64 **v28;
__int64 *v29;
int v30;
int v31;
unsigned __int16 v32;
INT64 *v33;
__int64 **v34;
INT64 v35;
unsigned __int64 v36;
unsigned __int64 k;
INT64 v38;
INT64 v39;
UINT64 v40;
unsigned __int64 v41;
__int64 **v42;
__int64 *Entry;
int v44;
int v45;
unsigned __int16 v46;
INT64 *v47;
unsigned __int64 j;
INT64 v49;
__int64 **v51;
__int64 *v52;
int v53;
int v54;
unsigned __int16 v55;
INT64 *v56;
unsigned __int64 m;
INT64 v58;
UINT64 v59;
unsigned __int64 v60;
__int64 **v61;
__int64 *v62;
int v63;
int v64;
unsigned __int16 v65;
INT64 *v66;
__int64 **v67;
INT64 v68;
unsigned __int64 n;
INT64 v70;
INT64 v71;
INT64 v72;
int v73;
int v74;
int v75;
int v76;
INT64 v77;
v7 = 0;
*(_BYTE *)(a3 + 15) = 0;
*(_BYTE *)(a3 + 10) = a4;
*(_WORD *)(a3 + 12) = *(_WORD *)(a1 + 140) ^ a6;
v10 = *(_QWORD *)(a2 + 40);
if( v10 == a2 )
{
LOBYTE(v11) = 0;
}
else
{
v11 = ((a3 - a2) >> 16) + 1;
if( v11 >= 0xFE )
RtlpLogHeapFailure(3i64, v10, a3, a2, 0i64, 0i64);
}
*(_BYTE *)(a3 + 14) = v11;
v13 = a7;
v14 = a3 + 16 * a7;
*(_BYTE *)(a3 + 11) = 0;
*(_WORD *)(a3 + 8) = a7;
while( ((*(_BYTE *)(v14 + 10) ^ (unsigned __int8)(*(_BYTE *)(a1 + 138) & (*(_DWORD *)(a1 + 124) >> 20))) & 1) == 0 )
{
if( *(_DWORD *)(a1 + 124) )
{
*(_DWORD *)(v14 + 8) ^= *(_DWORD *)(a1 + 136);
if( *(_BYTE *)(v14 + 11) != (*(_BYTE *)(v14 + 8) ^ (unsigned __int8)(*(_BYTE *)(v14 + 9) ^ *(_BYTE *)(v14 + 10))) )
RtlpAnalyzeHeapFailure(a1, a3 + 16 * a7);
}
v15 = *(INT64 **)(v14 + 24);
v16 = *(_QWORD *)(v14 + 16);
v77 = (INT64)v15;
v17 = *v15;
v18 = *(_QWORD *)(v16 + 8);
if( *v15 == v18 && v17 == v14 + 16 )
{
*(_QWORD *)(a1 + 192) -= *(unsigned __int16 *)(v14 + 8);
v19 = *(_QWORD *)(a1 + 312);
if( v19 )
{
v20 = *(unsigned __int16 *)(v14 + 8);
for( i = *(unsigned int *)(v19 + 8); ; i = *(unsigned int *)(v22 + 8) )
{
if( v20 < i )
{
v23 = *(unsigned __int16 *)(v14 + 8);
goto LABEL_20;
}
v22 = *(_QWORD *)v19;
if( !*(_QWORD *)v19 )
break;
v19 = *(_QWORD *)v19;
}
v23 = *(_DWORD *)(v19 + 8) - 1;
LABEL_20:
LODWORD(v72) = v23;
RtlpHeapRemoveListEntry(a1, v19, v20, (INT64 *)(v14 + 16), v72, *(unsigned __int16 *)(v14 + 8));
v15 = (INT64 *)v77;
}
*v15 = v16;
*(_QWORD *)(v16 + 8) = v15;
if( a5 )
{
v24 = *(_BYTE *)(v14 + 10);
if( (v24 & 4) != 0 )
{
v25 = 16i64 * *(unsigned __int16 *)(v14 + 8) - 32;
if( (v24 & 2) != 0 && v25 > 4 )
v25 = 16i64 * *(unsigned __int16 *)(v14 + 8) - 36;
v26 = RtlCompareMemoryUlong((PVOID)(v14 + 32), v25, 0xFEEEFEEE);
if( v26 != v25 )
{
DbgPrint(
"HEAP: Free Heap block %p modified at %p after it was freed\n",
(const void *)(a3 + 16 * a7),
(const void *)(v26 + v14 + 32));
if( (_BYTE)KdDebuggerEnabled )
__debugbreak();
}
}
}
*(_BYTE *)(a3 + 10) = *(_BYTE *)(v14 + 10);
v27 = *(unsigned __int16 *)(v14 + 8) + a7;
if( v27 > 0xFF00 )
{
RtlpInsertFreeBlock(a1, a3, v27);
return 1;
}
*(_WORD *)(a3 + 8) = v27;
*(_WORD *)(a3 + 16 * v27 + 12) = *(_WORD *)(a1 + 140) ^ v27;
*(_BYTE *)(a3 + 15) = 0;
if( a5 )
{
*(_BYTE *)(a3 + 10) &= 0xF0u;
if( (*(_DWORD *)(a1 + 112) & 0x40) != 0 )
{
v40 = a3 + 32;
v41 = (16 * (unsigned __int64)(unsigned __int16)v27 - 32) >> 2;
if( v41 )
{
if( (v40 & 4) != 0 )
{
--v41;
*(_DWORD *)v40 = -17891602;
v40 = a3 + 36;
}
memset64((void *)v40, 0xFEEEFEEEFEEEFEEEui64, v41 >> 1);
if( (v41 & 1) != 0 )
*(_DWORD *)(v40 + 4 * v41 - 4) = -17891602;
}
*(_BYTE *)(a3 + 10) |= 4u;
}
v42 = (__int64 **)(a1 + 336);
if( *(_QWORD *)(a1 + 312) )
Entry = RtlpFindEntry(a1, (unsigned __int16)v27);
else
Entry = *v42;
if( v42 != (__int64 **)Entry )
{
v44 = *(_DWORD *)(a1 + 124);
do
{
if( v44 )
{
v45 = *((_DWORD *)Entry - 2);
v44 = *(_DWORD *)(a1 + 124);
LOWORD(v74) = v45;
if( (v45 & v44) != 0 )
v74 = *(_DWORD *)(a1 + 136) ^ v45;
v46 = v74;
}
else
{
v46 = *((_WORD *)Entry - 4);
}
if( (unsigned __int16)v27 <= (unsigned __int64)v46 )
break;
Entry = (__int64 *)*Entry;
}
while( v42 != (__int64 **)Entry );
}
v47 = (INT64 *)Entry[1];
v34 = (__int64 **)(a3 + 16);
if( (__int64 *)*v47 == Entry )
{
*v34 = Entry;
*(_QWORD *)(a3 + 24) = v47;
*v47 = (INT64)v34;
Entry[1] = (__int64)v34;
}
else
{
RtlpLogHeapFailure(13i64, 0i64, (UINT64)Entry, 0i64, *v47, 0i64);
}
*(_QWORD *)(a1 + 192) += *(unsigned __int16 *)(a3 + 8);
v35 = *(_QWORD *)(a1 + 312);
if( v35 )
{
v36 = *(unsigned __int16 *)(a3 + 8);
for( j = *(unsigned int *)(v35 + 8); v36 >= j; j = *(unsigned int *)(v49 + 8) )
{
v49 = *(_QWORD *)v35;
if( !*(_QWORD *)v35 )
goto LABEL_84;
v35 = *(_QWORD *)v35;
}
goto LABEL_52;
}
}
else
{
*(_BYTE *)(a3 + 10) = 0;
v28 = (__int64 **)(a1 + 336);
if( *(_QWORD *)(a1 + 312) )
v29 = RtlpFindEntry(a1, (unsigned __int16)v27);
else
v29 = *v28;
if( v28 != (__int64 **)v29 )
{
v30 = *(_DWORD *)(a1 + 124);
do
{
if( v30 )
{
v31 = *((_DWORD *)v29 - 2);
v30 = *(_DWORD *)(a1 + 124);
LOWORD(v73) = v31;
if( (v31 & v30) != 0 )
v73 = *(_DWORD *)(a1 + 136) ^ v31;
v32 = v73;
}
else
{
v32 = *((_WORD *)v29 - 4);
}
if( (unsigned __int16)v27 <= (unsigned __int64)v32 )
break;
v29 = (__int64 *)*v29;
}
while( v28 != (__int64 **)v29 );
}
v33 = (INT64 *)v29[1];
v34 = (__int64 **)(a3 + 16);
if( (__int64 *)*v33 == v29 )
{
*v34 = v29;
*(_QWORD *)(a3 + 24) = v33;
*v33 = (INT64)v34;
v29[1] = (__int64)v34;
}
else
{
RtlpLogHeapFailure(13i64, 0i64, (UINT64)v29, 0i64, *v33, 0i64);
}
*(_QWORD *)(a1 + 192) += *(unsigned __int16 *)(a3 + 8);
v35 = *(_QWORD *)(a1 + 312);
if( v35 )
{
v36 = *(unsigned __int16 *)(a3 + 8);
for( k = *(unsigned int *)(v35 + 8); v36 >= k; k = *(unsigned int *)(v38 + 8) )
{
v38 = *(_QWORD *)v35;
if( !*(_QWORD *)v35 )
goto LABEL_84;
v35 = *(_QWORD *)v35;
}
goto LABEL_52;
}
}
goto LABEL_54;
}
RtlpLogHeapFailure(13i64, a1, v14 + 16, v18, v17, 0i64);
if( v7 )
return 0;
v7 = 1;
}
*(_WORD *)(v14 + 12) = *(_WORD *)(a1 + 140) ^ v13;
*(_BYTE *)(a3 + 15) = 0;
if( !a5 )
{
*(_BYTE *)(a3 + 10) = 0;
v51 = (__int64 **)(a1 + 336);
if( *(_QWORD *)(a1 + 312) )
v52 = RtlpFindEntry(a1, (unsigned __int16)a7);
else
v52 = *v51;
if( v51 != (__int64 **)v52 )
{
v53 = *(_DWORD *)(a1 + 124);
do
{
if( v53 )
{
v54 = *((_DWORD *)v52 - 2);
v53 = *(_DWORD *)(a1 + 124);
LOWORD(v75) = v54;
if( (v53 & v54) != 0 )
v75 = *(_DWORD *)(a1 + 136) ^ v54;
v55 = v75;
}
else
{
v55 = *((_WORD *)v52 - 4);
}
if( (unsigned __int16)a7 <= (unsigned __int64)v55 )
break;
v52 = (__int64 *)*v52;
}
while( v51 != (__int64 **)v52 );
}
v56 = (INT64 *)v52[1];
v34 = (__int64 **)(a3 + 16);
if( (__int64 *)*v56 == v52 )
{
*v34 = v52;
*(_QWORD *)(a3 + 24) = v56;
*v56 = (INT64)v34;
v52[1] = (__int64)v34;
}
else
{
RtlpLogHeapFailure(13i64, 0i64, (UINT64)v52, 0i64, *v56, 0i64);
}
*(_QWORD *)(a1 + 192) += *(unsigned __int16 *)(a3 + 8);
v35 = *(_QWORD *)(a1 + 312);
if( v35 )
{
v36 = *(unsigned __int16 *)(a3 + 8);
for( m = *(unsigned int *)(v35 + 8); v36 >= m; m = *(unsigned int *)(v58 + 8) )
{
v58 = *(_QWORD *)v35;
if( !*(_QWORD *)v35 )
{
LABEL_84:
v39 = (unsigned int)(*(_DWORD *)(v35 + 8) - 1);
goto LABEL_53;
}
v35 = *(_QWORD *)v35;
}
LABEL_52:
v39 = v36;
LABEL_53:
LODWORD(v72) = v39;
RtlpHeapAddListEntry(a1, v35, v39, (INT64)v34, v72, v36);
}
LABEL_54:
if( *(_DWORD *)(a1 + 124) )
{
*(_BYTE *)(a3 + 11) = *(_BYTE *)(a3 + 8) ^ *(_BYTE *)(a3 + 9) ^ *(_BYTE *)(a3 + 10);
*(_DWORD *)(a3 + 8) ^= *(_DWORD *)(a1 + 136);
}
return 1;
}
*(_BYTE *)(a3 + 10) &= 0xF0u;
if( (*(_DWORD *)(a1 + 112) & 0x40) != 0 )
{
v59 = a3 + 32;
v60 = (16 * (unsigned __int64)(unsigned __int16)a7 - 32) >> 2;
if( v60 )
{
if( (v59 & 4) != 0 )
{
--v60;
*(_DWORD *)v59 = -17891602;
v59 = a3 + 36;
}
memset64((void *)v59, 0xFEEEFEEEFEEEFEEEui64, v60 >> 1);
if( (v60 & 1) != 0 )
*(_DWORD *)(v59 + 4 * v60 - 4) = -17891602;
}
*(_BYTE *)(a3 + 10) |= 4u;
}
v61 = (__int64 **)(a1 + 336);
if( *(_QWORD *)(a1 + 312) )
v62 = RtlpFindEntry(a1, (unsigned __int16)a7);
else
v62 = *v61;
if( v61 != (__int64 **)v62 )
{
v63 = *(_DWORD *)(a1 + 124);
do
{
if( v63 )
{
v64 = *((_DWORD *)v62 - 2);
v63 = *(_DWORD *)(a1 + 124);
LOWORD(v76) = v64;
if( (v63 & v64) != 0 )
v76 = *(_DWORD *)(a1 + 136) ^ v64;
v65 = v76;
}
else
{
v65 = *((_WORD *)v62 - 4);
}
if( (unsigned __int16)a7 <= (unsigned __int64)v65 )
break;
v62 = (__int64 *)*v62;
}
while( v61 != (__int64 **)v62 );
}
v66 = (INT64 *)v62[1];
v67 = (__int64 **)(a3 + 16);
if( (__int64 *)*v66 == v62 )
{
*v67 = v62;
*(_QWORD *)(a3 + 24) = v66;
*v66 = (INT64)v67;
v62[1] = (__int64)v67;
}
else
{
RtlpLogHeapFailure(13i64, 0i64, (UINT64)v62, 0i64, *v66, 0i64);
}
*(_QWORD *)(a1 + 192) += *(unsigned __int16 *)(a3 + 8);
v68 = *(_QWORD *)(a1 + 312);
if( v68 )
{
for( n = *(unsigned int *)(v68 + 8); ; n = *(unsigned int *)(v70 + 8) )
{
if( *(unsigned __int16 *)(a3 + 8) < n )
{
v71 = *(unsigned __int16 *)(a3 + 8);
goto LABEL_137;
}
v70 = *(_QWORD *)v68;
if( !*(_QWORD *)v68 )
break;
v68 = *(_QWORD *)v68;
}
v71 = (unsigned int)(*(_DWORD *)(v68 + 8) - 1);
LABEL_137:
LODWORD(v72) = v71;
RtlpHeapAddListEntry(a1, v68, v71, a3 + 16, v72, *(unsigned __int16 *)(a3 + 8));
}
if( *(_DWORD *)(a1 + 124) )
{
*(_BYTE *)(a3 + 11) = *(_BYTE *)(a3 + 8) ^ *(_BYTE *)(a3 + 9) ^ *(_BYTE *)(a3 + 10);
*(_DWORD *)(a3 + 8) ^= *(_DWORD *)(a1 + 136);
}
return 1;
}Referenced by:
RtlpAllocateHeap