SmKmStoreAdd

__int64 __fastcall SmKmStoreAdd(__int64 a1, __int64 a2, __int64 a3, int *a4){
  unsigned int v4; 
  __int64 v5; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  volatile INT64 *v9; 
  _ETHREAD *v10; 
  _ETHREAD *v11; 
  volatile signed __int64 *v12; 
  __int16 v13; 
  int v14; 
  UINT64 *v15; 
  EVENT_DESCRIPTOR *v16; 
  unsigned __int64 NonPaged; 
  struct _PRIVILEGE_SET *v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  _ETHREAD *CurrentThread; 
  _DWORD *v24; 
  v4 = 0;
  v24 = *(_DWORD **)a3;
  v5 = 0i64;
  do
  {
    if( !*(_QWORD *)(a1 + 8 * v5) )
    {
      NonPaged = SSHSupportAllocateNonPaged(0x500ui64, 0x61536D73u);
      v20 = (struct _PRIVILEGE_SET *)NonPaged;
      if( !NonPaged )
        return(unsigned int)-1073741670;
      v21 = NonPaged + 1280;
      if( NonPaged < NonPaged + 1280 )
      {
        v22 = NonPaged + 8;
        do
        {
          *(_OWORD *)(v22 - 8) = 0i64;
          *(_OWORD *)(v22 + 8) = 0i64;
          *(_QWORD *)(v22 + 24) = 0i64;
          ExInitializePushLock((EX_RUNDOWN_REF *)v22);
          ExWaitForRundownProtectionRelease((EX_RUNDOWN_REF *)v22);
          *(_QWORD *)(v22 + 8) = 0i64;
          v22 += 40i64;
        }
        while( v22 - 8 < v21 );
      }
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockExclusiveEx(a1 + 416, 0i64);
      if( !*(_QWORD *)(a1 + 8 * v5) )
      {
        *(_QWORD *)(a1 + 8 * v5) = v20;
        v20 = 0i64;
      }
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 416), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)(a1 + 416));
      KeAbPostRelease((PVOID)(a1 + 416));
      KeLeaveCriticalRegion();
      if( v20 )
        CmSiFreeMemory(v20);
    }
    v7 = *(_QWORD *)(a1 + 8 * v5);
    v8 = v7 + 1280;
    if( v7 >= v7 + 1280 )
      goto LABEL_35;
    v9 = (volatile INT64 *)(v7 + 16);
    while( *(_QWORD *)v7 )
    {
LABEL_6:
      v7 += 40i64;
      v9 += 5;
      ++v4;
      if( v7 >= v8 )
        goto LABEL_9;
    }
    v10 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v10 + 242);
    ExAcquirePushLockExclusiveEx((UINT64)v9, 0i64);
    if( *(_QWORD *)v7 )
    {
      if( (_InterlockedExchangeAdd64(v9, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v9);
      KeAbPostRelease((PVOID)v9);
      KeLeaveCriticalRegion();
      goto LABEL_6;
    }
LABEL_9:
    if( v7 < v8 )
      break;
LABEL_35:
    v5 = (unsigned int)(v5 + 1);
  }
  while( (unsigned int)v5 < 0x20 );
  if( v4 >= 0x400 )
  {
    return(unsigned int)-1073741671;
  }
  else
  {
    v11 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v11 + 242);
    v12 = (volatile signed __int64 *)(a1 + 416);
    ExAcquirePushLockExclusiveEx(a1 + 416, 0i64);
    if( (*v24 & 0x100) == 0 )
      goto LABEL_12;
    if( *(_DWORD *)(a1 + 432) == -1 )
    {
      *(_DWORD *)(a1 + 432) = v4;
LABEL_12:
      *(_BYTE *)(v7 + 34) &= ~1u;
      *(_BYTE *)(v7 + 34) &= ~2u;
      *(_WORD *)(v7 + 32) ^= (*(_WORD *)(v7 + 32) ^ (*v24 >> 18 << 7)) & 0x80;
      *(_QWORD *)(v7 + 24) = *(_QWORD *)(a3 + 16);
      ++*(_DWORD *)(a1 + 424);
      if( (_InterlockedExchangeAdd64(v12, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)(a1 + 416));
      KeAbPostRelease((PVOID)(a1 + 416));
      KeLeaveCriticalRegion();
      *(_QWORD *)v7 = a2;
      do
      {
        v13 = *(_WORD *)(v7 + 32) ^ (*(_WORD *)(v7 + 32) ^ (*(_WORD *)(v7 + 32) + 1)) & 0x3F;
        *(_WORD *)(v7 + 32) = v13;
        v14 = v4 | ((v13 & 0x3F) << 10);
        *a4 = v14;
      }
      while( v14 == 66559 );
      v15 = SmEtwEnabled(0i64);
      if( v15 )
        SmKmEtwLogStoreChange(v15, *(PVOID *)v7, (EVENT_DESCRIPTOR *)&SmEventStoreCreate, v16);
      _InterlockedExchange64((volatile __int64 *)(v7 + 8), 0i64);
      ExAcquireRundownProtection((PEX_RUNDOWN_REF)(v7 + 8));
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v7 + 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)(v7 + 16));
      KeAbPostRelease((PVOID)(v7 + 16));
      KeLeaveCriticalRegion();
      return 0;
    }
    else
    {
      if( (_InterlockedExchangeAdd64(v12, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)(a1 + 416));
      KeAbPostRelease((PVOID)(a1 + 416));
      KeLeaveCriticalRegion();
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v7 + 16), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)(v7 + 16));
      KeAbPostRelease((PVOID)(v7 + 16));
      KeLeaveCriticalRegion();
      return(unsigned int)-1073740757;
    }
  }
}

Referenced by: