ExpSaPageGroupAllocateMemory

_EXP_SA_HANDLE __stdcall ExpSaPageGroupAllocateMemory(_EX_SA_PAGE_GROUP_DESCRIPTOR *Group, UINT64 SizeInPointers){
  UINT64 v3; 
  UINT64 v4; 
  _ETHREAD *CurrentThread; 
  unsigned int v6; 
  unsigned __int8 AbEntrySummary; 
  __int64 v8; 
  __int64 v9; 
  NTSTATUS SessionId; 
  bool v11; 
  UINT64 ClearBitsAndSet; 
  _EXP_SA_HANDLE v13; 
  _ETHREAD *v14; 
  unsigned __int8 v15; 
  int v16; 
  __int64 v17; 
  _KLOCK_ENTRY *v18; 
  __int64 v19; 
  __int64 AbOrphanedEntrySummary; 
  UINT64 v22; 
  int v23; 
  int v24; 
  UINT64 a3; 

  v3 = (unsigned int)SizeInPointers;
  if( Group[9] < (unsigned int)SizeInPointers )
    return -1;
  LODWORD(a3) = 0;
  v4 = (UINT64)(Group + 6);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.SpecialApcDisable;
  if( ++CurrentThread->Tcb.AbAllocationRegionCount != 1 )
    KeBugCheckEx(0x192u, CurrentThread, Group + 6, (PVOID)KeGetCurrentIrql(), 0i64);
  v24 = 0;
  v6 = -1;
  AbEntrySummary = CurrentThread->Tcb.AbEntrySummary;
  if( !AbEntrySummary )
  {
    if( !CurrentThread->Tcb.AbOrphanedEntrySummary )
    {
      v9 = 0i64;
      goto LABEL_41;
    }
    AbOrphanedEntrySummary = CurrentThread->Tcb.AbOrphanedEntrySummary;
    CurrentThread->Tcb.AbOrphanedEntrySummary = 0;
    AbEntrySummary = AbOrphanedEntrySummary | CurrentThread->Tcb.AbEntrySummary;
  }
  _BitScanForward((unsigned int *)&v8, AbEntrySummary);
  v24 = v8;
  CurrentThread->Tcb.AbEntrySummary = AbEntrySummary & ~(1 << v8);
  v9 = (__int64)&CurrentThread->Tcb.LockEntries[v8];
  if( !v9 )
  {
LABEL_41:
    _interlockedbittestandset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 0x10u);
    goto LABEL_9;
  }
  if( v4 >= 0xFFFF800000000000ui64 && *((_BYTE *)&stru_140C4DB30 + ((v4 >> 39) & 0x1FF) + 6872) == 1 )
    SessionId = MmGetSessionIdEx(CurrentThread->Tcb.ApcState.Process);
  else
    SessionId = -1;
  *(_DWORD *)(v9 + 40) = SessionId;
  *(_QWORD *)(v9 + 32) = v4 & 0x7FFFFFFFFFFFFFFCi64;
LABEL_9:
  --CurrentThread->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&CurrentThread->Tcb, (VOID *)v4, &a3);
  v11 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
  if( v11
    && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
  {
    KiCheckForKernelApcDelivery();
  }
  if( _interlockedbittestandset64((volatile signed __int32 *)v4, 0i64) )
    ExfAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v4, (VOID *)v9, (VOID *)v4);
  if( v9 )
    *(_BYTE *)(v9 + 26) |= 1u;
  if( Group[9] < (unsigned int)v3
    || (ClearBitsAndSet = RtlFindClearBitsAndSetEx((_RTL_BITMAP_EX *)Group + 3, v3, (unsigned int)Group[11]),
        ClearBitsAndSet == -1i64) )
  {
    v13 = -1;
  }
  else
  {
    Group[9] -= v3;
    Group[11] = ClearBitsAndSet + v3;
    v13 = 16 * (ClearBitsAndSet & 0x1FF | ((Group[8] & 0x3FFFF) << 9));
  }
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v4, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)v4);
  LODWORD(v22) = 0;
  v14 = (_ETHREAD *)KeGetCurrentThread();
  if( MiGetSystemRegionType(v4) == 1 )
    v6 = MmGetSessionIdEx(v14->Tcb.ApcState.Process);
  --v14->Tcb.SpecialApcDisable;
  v15 = ++v14->Tcb.AbAllocationRegionCount;
  v16 = ((char)v14->Tcb.AbEntrySummary | (char)v14->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
  while( 1 )
  {
    v11 = !_BitScanReverse((unsigned int *)&v17, v16);
    v23 = v17;
    if( v11 )
      break;
    v18 = &v14->Tcb.LockEntries[v17];
    v16 &= ~(1 << v17);
    if( (v18->AcquiredByte & 1) != 0
      && (v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
      && (v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v4 & 0x7FFFFFFFFFFFFFFCi64)
      && v18->LockState.SessionId == v6 )
    {
      v18->AcquiredByte &= ~1u;
      if( v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
      {
        if( v18 )
        {
          v18->CrossThreadReleasableAndBusyByte |= 2u;
          if( v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
            KiAbEntryRemoveFromTree(v18);
          LODWORD(v22) = v18->BoostBitmap.AllFields & 0x1FFFF;
          v18->BoostBitmap.AllFields &= 0xFFFE0000;
          v18->ThreadLocalFlags &= ~1u;
          v18->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
          v19 = v18 - v14->Tcb.LockEntries;
          if( v15 == 1 )
            v14->Tcb.AbEntrySummary |= 1 << v19;
          else
            _InterlockedOr8((volatile signed __int8 *)&v14->Tcb.AbOrphanedEntrySummary, 1 << v19);
          goto LABEL_35;
        }
        break;
      }
    }
  }
  if( (*(&v14->Tcb.MiscFlags + 1) & 0x10000) == 0 )
    KeBugCheckEx(0x162u, v14, (PVOID)v4, (PVOID)v6, 0i64);
LABEL_35:
  --v14->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&v14->Tcb, (VOID *)v4, &v22);
  v11 = v14->Tcb.SpecialApcDisable++ == -1;
  if( v11 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v14->Tcb.ApcState.ApcListHead[0].Flink != &v14->Tcb.152 )
    KiCheckForKernelApcDelivery();
  return v13;
}

Referenced by: