ExpFreeHeapSpecialPool

NTSTATUS __stdcall ExpFreeHeapSpecialPool(PVOID HeapAddress, UINT64 BugCheckParameter1){
  POOL_TYPE v4; 
  __int16 v5; 
  POOL_TYPE v6; 
  UINT64 v7; 
  int v8; 
  unsigned __int8 CurrentIrql; 
  _DWORD *v10; 
  UINT64 v11; 
  _BYTE *i; 
  __int64 v13; 
  __int64 v14; 
  int v15; 
  UINT8 *v16; 
  unsigned int v17; 
  __int64 v18; 
  UINT8 *v19; 
  int v20; 
  int v21; 
  v4 = (unsigned int)MiDeterminePoolType(BugCheckParameter1);
  v6 = NonPagedPool;
  if( v4 != NonPagedPoolSession )
    v6 = v4;
  v7 = 4096 - (v5 & 0xFFFu);
  ExpFreePoolChecks((PVOID)BugCheckParameter1, v7, NonPagedPool);
  v8 = v6 & 1;
  CurrentIrql = KeGetCurrentIrql();
  if( CurrentIrql > (unsigned __int8)(2 - (v8 != 0)) )
    KeBugCheckEx(0xC1u, CurrentIrql, 1ui64, BugCheckParameter1, 0x31ui64);
  v10 = (_DWORD *)(BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64);
  v11 = *(_WORD *)(BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) & 0x1FFF;
  if( ((v11 + 15) & 0xFFFFFFFFFFFFFFF0ui64) != v7 )
    KeBugCheckEx(
      0xC1u,
      BugCheckParameter1,
      *(_WORD *)(BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) & 0x1FFF,
      v7,
      0x21ui64);
  for( i = (char *)v10 + ((*v10 & 0x4000) != 0 ? 24i64 : 16i64); (unsigned __int64)i < BugCheckParameter1; ++i )
  {
    if( *i != *(_BYTE *)((BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) + 2) )
      KeBugCheckEx(0xC1u, BugCheckParameter1, (ULONG_PTR)i, (unsigned int)*v10, 0x23ui64);
  }
  if( (*v10 & 0x4000) != 0 )
    VerifierFreeTrackedPool(
      (PVOID)BugCheckParameter1,
      *(_WORD *)(BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) & 0x1FFF,
      (unsigned int)v6,
      1ui64);
  v13 = *(unsigned int *)((BugCheckParameter1 & 0xFFFFFFFFFFFFF000ui64) + 4);
  if( (_DWORD)v13 == PoolHitTag )
    __debugbreak();
  v14 = HIDWORD(PerfGlobalGroupMask);
  if( (v6 & 0x20) != 0 )
  {
    v16 = (UINT8 *)ExpSessionPoolTrackTable;
    v15 = ExpSessionPoolTrackTableMask;
  }
  else
  {
    LODWORD(v14) = *((_DWORD *)KeGetPcr() + 105);
    v15 = PoolTrackTableMask;
    v16 = (&ExPoolTagTables)[v14];
  }
  v17 = v15 & ((40543 * v13) ^ ((unsigned __int64)(40543 * v13) >> 32));
  while( 1 )
  {
    v18 = 56i64 * v17;
    v19 = &v16[v18];
    v20 = *(_DWORD *)&v16[v18];
    if( v20 == (_DWORD)v13 )
      break;
    if( v20 || (v6 & 0x20) != 0 || (v21 = *(_DWORD *)((char *)PoolTrackTable + v18)) == 0 )
    {
      v17 = v15 & (v17 + 1);
      if( v17 == (v15 & ((40543 * (int)v13) ^ ((unsigned __int64)(40543 * v13) >> 32))) )
      {
        ExpRemovePoolTrackerExpansion((unsigned int)v13, v11, v6);
        return RtlpHpFreeHeap(HeapAddress, v10, 0i64);
      }
    }
    else
    {
      *(_DWORD *)v19 = v21;
    }
  }
  _InterlockedIncrement64((volatile signed __int64 *)&v19[(v8 != 0 ? 0x18 : 0) + 24]);
  _InterlockedExchangeAdd64((volatile signed __int64 *)&v19[(v8 != 0 ? 0x18 : 0) + 8], -(__int64)v11);
  return RtlpHpFreeHeap(HeapAddress, v10, 0i64);
}

Referenced by: