MiMarkSystemVaAllocated

NTSTATUS __stdcall MiMarkSystemVaAllocated(UINT64 a1, INT64 a2, INT64 r8_0, INT64 a4, INT64 a5){
  _MM_SESSION_SPACE *Session; 
  __int64 v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  INT64 *v9; 
  unsigned __int64 v10; 
  _RTL_BITMAP_EX *v11; 
  NTSTATUS v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  unsigned int v15; 
  unsigned __int64 *Buffer; 
  unsigned __int64 *v17; 
  unsigned __int64 v18; 
  unsigned __int64 *v19; 
  bool v20; 
  bool i; 
  UINT64 v22; 
  _ETHREAD *v23; 
  unsigned int SessionId; 
  unsigned __int8 v25; 
  int v26; 
  _KLOCK_ENTRY *v27; 
  __int64 v28; 
  __int64 v29; 
  UINT32 v31; 
  UINT64 a3; 
  _ETHREAD *CurrentThread; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  unsigned int LogFileName; 
  int v36; 

  v36 = a4;
  LogFileName = a1;
  CurrentThread = 0i64;
  memset(&LockHandle, 0, sizeof(LockHandle));
  Session = 0i64;
  v6 = (_QWORD)MmGetPteBase() << 25;
  v7 = (r8_0 - a2) >> 3;
  v8 = ((((a2 << 25) - v6) >> 16 << 25) - v6) >> 16;
  if( (_DWORD)a1 == 1 )
  {
    v9 = 0i64;
    v10 = qword_140C4CAE0;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    Session = CurrentThread->Tcb.ApcState.Process->Session;
    --CurrentThread->Tcb.SpecialApcDisable;
    v11 = (_RTL_BITMAP_EX *)((char *)Session + 832);
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)KeGetCurrentThread()->ApcState.Process->Session + 103, 0i64);
  }
  else
  {
    v9 = MiSystemVaToDynamicBitmap(a1);
    v11 = (_RTL_BITMAP_EX *)v9;
    v10 = v9[4];
    KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)v9 + 8, &LockHandle);
  }
  if( v8 < v10 )
    goto LABEL_5;
  v13 = (v8 - v10) >> 21;
  if( (_DWORD)a5 && (v14 = v13 + v7 - 1, v14 >= v11->SizeOfBitMap) )
  {
    if( v14 >= v9[2]
      || (v15 = LogFileName,
          !MiExtendDynamicBitMap(
             (PHANDLE)v9,
             (_ACCESS_MASK)v11,
             (POBJECT_ATTRIBUTES)((v14 - v11->SizeOfBitMap + 0x8000) & 0xFFFFFFFFFFFF8000ui64),
             (PUNICODE_STRING)LogFileName,
             1u,
             v31)) )
    {
LABEL_5:
      v12 = 0;
      goto LABEL_33;
    }
  }
  else
  {
    v15 = LogFileName;
  }
  if( v36 == 1 )
  {
    if( v13 < v11->SizeOfBitMap )
    {
      if( v7 <= 1 )
      {
        if( v7 != 1 || _bittest64((const signed __int64 *)v11->Buffer, v13) )
          goto LABEL_17;
LABEL_27:
        RtlSetBitsEx(v11, v13, v7);
        v12 = 1;
        if( Session )
        {
          *((_DWORD *)Session + 218) += v7;
          goto LABEL_33;
        }
        goto LABEL_32;
      }
      if( v11->SizeOfBitMap - v13 >= v7 )
      {
        Buffer = v11->Buffer;
        v17 = &Buffer[v13 >> 6];
        v18 = *v17;
        v19 = &Buffer[(v13 + v7 - 1) >> 6];
        if( v17 != v19 )
        {
          for( i = (v18 & (-1i64 << v13)) == 0; i; i = *v17 == 0 )
          {
            if( ++v17 == v19 )
            {
              v20 = ((0xFFFFFFFFFFFFFFFFui64 >> ~((unsigned __int8)v13 + (unsigned __int8)v7 - 1)) & *v17) == 0;
              goto LABEL_26;
            }
          }
          goto LABEL_17;
        }
        v20 = (v18 & (0xFFFFFFFFFFFFFFFFui64 >> (64 - (unsigned __int8)v7) << v13)) == 0;
LABEL_26:
        if( v20 )
          goto LABEL_27;
      }
    }
LABEL_17:
    v12 = 0;
    goto LABEL_33;
  }
  RtlClearBitsEx(v11, v13, v7);
  v12 = 1;
  if( Session )
  {
    *((_DWORD *)Session + 218) -= v7;
    goto LABEL_33;
  }
  v7 = -(__int64)v7;
LABEL_32:
  _InterlockedExchangeAdd64(&MiState[(int)v15 + 1553], v7);
LABEL_33:
  if( Session )
  {
    v22 = (UINT64)KeGetCurrentThread()->ApcState.Process->Session + 824;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v22, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)v22);
    LODWORD(a3) = 0;
    v23 = (_ETHREAD *)KeGetCurrentThread();
    if( MiGetSystemRegionType(v22) == 1 )
      SessionId = MmGetSessionIdEx(v23->Tcb.ApcState.Process);
    else
      SessionId = -1;
    --v23->Tcb.SpecialApcDisable;
    v25 = ++v23->Tcb.AbAllocationRegionCount;
    v26 = ((char)v23->Tcb.AbEntrySummary | (char)v23->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
    while( 1 )
    {
      v20 = !_BitScanReverse((unsigned int *)&v28, v26);
      if( v20 )
        goto LABEL_46;
      v27 = &v23->Tcb.LockEntries[v28];
      v26 &= ~(1 << v28);
      if( (v27->AcquiredByte & 1) != 0
        && (v27->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
        && (v27->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v22 & 0x7FFFFFFFFFFFFFFCi64)
        && v27->LockState.SessionId == SessionId )
      {
        v27->AcquiredByte &= ~1u;
        if( v27->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
          break;
      }
    }
    if( !v27 )
    {
LABEL_46:
      if( (*(&v23->Tcb.MiscFlags + 1) & 0x10000) == 0 )
        KeBugCheckEx(0x162u, v23, (PVOID)v22, (PVOID)SessionId, 0i64);
      goto LABEL_53;
    }
    v27->CrossThreadReleasableAndBusyByte |= 2u;
    if( v27->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
      KiAbEntryRemoveFromTree(v27);
    LODWORD(a3) = v27->BoostBitmap.AllFields & 0x1FFFF;
    v27->BoostBitmap.AllFields &= 0xFFFE0000;
    v27->ThreadLocalFlags &= ~1u;
    v27->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
    v29 = v27 - v23->Tcb.LockEntries;
    if( v25 == 1 )
      v23->Tcb.AbEntrySummary |= 1 << v29;
    else
      _InterlockedOr8((volatile signed __int8 *)&v23->Tcb.AbOrphanedEntrySummary, 1 << v29);
LABEL_53:
    --v23->Tcb.AbAllocationRegionCount;
    KiAbThreadRemoveBoosts(&v23->Tcb, (VOID *)v22, &a3);
    v20 = v23->Tcb.SpecialApcDisable++ == -1;
    if( v20 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v23->Tcb.ApcState.ApcListHead[0].Flink != &v23->Tcb.152 )
      KiCheckForKernelApcDelivery();
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
  else
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
  }
  return v12;
}

Referenced by: