MiSelectOverflowDllBase

NTSTATUS __stdcall MiSelectOverflowDllBase(INT64 a1, UINT64 a2){
  unsigned __int64 v3; 
  int v4; 
  int v5; 
  unsigned __int64 v6; 
  int v7; 
  __int64 *v9; 
  __int64 v10; 
  __int64 *v11; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v13; 
  __int64 v14; 

  v3 = ((*(_DWORD *)(a1 + 8) << 12) + 0xFFFF) & 0xFFFF0000;
  LOBYTE(v4) = MiImageCanUseHighOverflowArea(a1, a2);
  v6 = v4 != 0 ? 0x10000000i64 : 0x4000000i64;
  if( v3 <= v6 )
  {
    v9 = &qword_140C4C8A8;
    if( v5 == 3 )
      v9 = (__int64 *)&unk_140C4C8D8;
    v10 = *v9;
    v11 = v9 + 1;
    if( v4 )
    {
      v10 = v9[2];
      v11 = v9 + 3;
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v13 = v6 + v10;
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx(&stru_140C4C888, 0i64);
    v14 = v10;
    if( v3 <= v13 - *v11 )
      v14 = *v11;
    *v11 = v14 + v3;
    if( v14 + v3 == v13 )
      *v11 = v10;
    if( (_InterlockedExchangeAdd64(&stru_140C4C888._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&stru_140C4C888);
    KeAbPostRelease(&stru_140C4C888);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    return v14;
  }
  else
  {
    v7 = (unsigned __int8)ExGenRandom(ExGenRandomDomainUserVisible) << 16;
    if( a2 < 0x1010000 || a2 > v3 + a2 || v3 + a2 > 0x7FFFFFFF0000i64 )
      return v7 + 0x10000;
    else
      return a2 - v7;
  }
}

Referenced by: