RtlpHpSegPageRangeAllocate
UINT64 __fastcall RtlpHpSegPageRangeAllocate(INT64 a1, INT64 a2, UINT64 a3){
__int64 v3;
unsigned int v4;
char v6;
unsigned int v7;
unsigned int v8;
unsigned int v9;
__int64 v10;
UINT64 v11;
UINT64 v12;
int v13;
UINT64 v14;
unsigned int v15;
unsigned __int16 v16;
int v17;
unsigned int v18;
bool v19;
INT64 v20;
int v22;
UINT64 v23;
INT64 v24;
UINT64 v25;
__int16 v26;
UINT64 v27;
_ETHREAD *v28;
char v29;
int v30;
__int64 v31;
unsigned __int64 v32;
__int64 v33;
_ETHREAD *CurrentThread;
char *v35;
char v36;
INT64 v37;
_ETHREAD *v38;
ULONG_PTR SessionId;
__int64 v40;
int v41;
__int64 v42;
unsigned __int64 v43;
__int64 v44;
unsigned __int8 v45;
INT64 v46;
int v47;
__int64 CurrentIrql;
UINT64 v49;
int v50;
char v51;
int v52;
int v53;
v4 = 1;
v6 = *(_BYTE *)(a1 + 9);
LOBYTE(v3) = -1;
v7 = a3;
CurrentIrql = v3;
v8 = (unsigned int)((1 << v6) + a2 - 1) >> v6;
v9 = v8 << 24;
v53 = a3 & 1;
if( (a3 & 1) == 0 )
{
if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
ExpAcquireSpinLockExclusive((INT64 *)(a1 + 64), CurrentIrql);
}
else
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx(a1 + 64, 0i64);
LOBYTE(CurrentIrql) = -1;
}
}
v10 = *(_QWORD *)(a1 + 104);
v11 = *(_QWORD *)(a1 + 96);
if( (v10 & 1) != 0 && v11 )
v11 ^= a1 + 96;
v12 = 0i64;
v13 = v10 & 1;
while( v11 )
{
if( v9 < *(_DWORD *)(v11 + 28) )
{
v14 = *(_QWORD *)v11;
v12 = v11;
if( v13 && v14 )
goto LABEL_29;
}
else
{
if( v9 <= *(_DWORD *)(v11 + 28) )
goto LABEL_14;
v14 = *(_QWORD *)(v11 + 8);
if( v13 && v14 )
{
LABEL_29:
v11 ^= v14;
continue;
}
}
v11 = v14;
}
v11 = v12;
LABEL_14:
v15 = -1;
if( !v11 )
goto LABEL_56;
if( (v7 & 0x800000) != 0 )
{
v11 = RtlpHpSegLargeRangeAllocate(a1, v11, v8, 1i64);
}
else
{
RtlRbRemoveNode((unsigned __int64 *)(a1 + 96), v11);
*(_OWORD *)v11 = 0i64;
*(_QWORD *)(v11 + 16) = 0i64;
v16 = ~(unsigned __int16)*(_DWORD *)(v11 + 28);
*(_DWORD *)v11 = -857879331;
_InterlockedExchangeAdd64((volatile signed __int64 *)(*(__int16 *)(a1 + 22) + a1 + 16), -(__int64)v16);
}
if( !v11 )
{
LABEL_56:
if( !v53 )
{
v37 = a1 + 64;
if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a1 + 64));
__writecr8((unsigned __int8)CurrentIrql);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v37, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)(a1 + 64));
v50 = 0;
v38 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(a1 + 64) == 1 )
SessionId = (unsigned int)MmGetSessionIdEx(*((_QWORD *)v38 + 23));
else
SessionId = 0xFFFFFFFFi64;
--*((_WORD *)v38 + 243);
v51 = ++*((_BYTE *)v38 + 794);
v40 = v37 & 0x7FFFFFFFFFFFFFFCi64;
v41 = (*((char *)v38 + 792) | *((char *)v38 + 870)) ^ 0x3F;
v19 = !_BitScanReverse((unsigned int *)&v42, v41);
v52 = v42;
if( v19 )
{
LABEL_85:
if( (*((_DWORD *)v38 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v38, v37, SessionId, 0i64);
}
else
{
while( 1 )
{
v43 = *((_QWORD *)v38 + 100) + 96 * v42;
v41 &= ~(1 << v42);
if( (*(_BYTE *)(v43 + 26) & 1) != 0
&& (*(_DWORD *)(v43 + 32) & 1) == 0
&& (*(_QWORD *)(v43 + 32) & 0x7FFFFFFFFFFFFFFCi64) == v40
&& *(_DWORD *)(v43 + 40) == (_DWORD)SessionId )
{
*(_BYTE *)(v43 + 26) &= ~1u;
if( *(_QWORD *)(v43 + 32) )
break;
}
v19 = !_BitScanReverse((unsigned int *)&v42, v41);
v52 = v42;
if( v19 )
goto LABEL_84;
}
if( !v43 )
{
LABEL_84:
v37 = a1 + 64;
goto LABEL_85;
}
*(_BYTE *)(v43 + 32) |= 2u;
if( *(__int64 *)(v43 + 32) < 0 )
KiAbEntryRemoveFromTree(v43);
v50 = *(_DWORD *)(v43 + 88) & 0x1FFFF;
*(_DWORD *)(v43 + 88) &= 0xFFFE0000;
*(_BYTE *)(v43 + 25) &= ~1u;
*(_QWORD *)(v43 + 32) = 0i64;
v44 = (unsigned __int128)((__int64)(v43 - *((_QWORD *)v38 + 100)) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
v37 = a1 + 64;
v45 = 1 << ((v44 >> 4) + (v44 < 0));
if( v51 == 1 )
*((_BYTE *)v38 + 792) |= v45;
else
_InterlockedOr8((volatile signed __int8 *)v38 + 870, v45);
}
--*((_BYTE *)v38 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v38, v37, (unsigned int *)&v50);
v19 = (*((_WORD *)v38 + 243))++ == 0xFFFF;
if( v19 && *((_ETHREAD **)v38 + 19) != (_ETHREAD *)((char *)v38 + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
}
v46 = RtlpHpSegSegmentAllocate(a1, 0i64, (v7 & 0x800000) != 0 ? 2 : 0);
v49 = v46;
if( !v46 )
return 0i64;
RtlpHpSegSegmentInitialize(a1, v46, 0i64);
v11 = v49 + 32i64 * *(unsigned __int8 *)(a1 + 10);
LOBYTE(CurrentIrql) = RtlpHpSegLockAcquire(a1, v7);
RtlpHpSegHeapAddSegment(a1, v49);
if( (v7 & 0x800000) != 0 )
v11 = RtlpHpSegLargeRangeAllocate(a1, v11, v8, 0i64);
}
v17 = *(unsigned __int8 *)(v11 + 31);
if( v17 != v8 )
{
v22 = v17 - v8;
v23 = (unsigned __int8)v22;
v24 = 32i64 * (unsigned int)(v22 - 1);
v25 = v11 + 32i64 * v8;
*(_BYTE *)(v25 + 24) |= 2u;
*(_BYTE *)(v24 + v25 + 31) = v23 - 1;
*(_BYTE *)(v25 + 31) = v23;
v26 = RtlpHpSegPageRangeCountCommittedPages(v24, v25, v23);
*(_DWORD *)v25 = -857879331;
*(_WORD *)(v25 + 28) = ~v26;
*(_BYTE *)(32i64 * (v8 - 1) + v11 + 31) = v8 - 1;
*(_BYTE *)(v11 + 31) = v8;
*(_WORD *)(v11 + 28) = ~(~(unsigned __int16)*(_DWORD *)(v11 + 28) + *(_WORD *)(v25 + 28) + 1);
RtlpHpSegFreeRangeInsert(a1, v25, 0i64);
}
v18 = v8 - 1;
*(_BYTE *)(v11 + 24) |= (unsigned __int8)(4 * ((v7 >> 26) & 3)) | 1;
v19 = v53 == 0;
*(_BYTE *)(32i64 * (v8 - 1) + v11 + 24) |= 1u;
if( v19 )
{
v20 = a1 + 64;
if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
{
*(_DWORD *)v20 = 0;
__writecr8((unsigned __int8)CurrentIrql);
}
else
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v20, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)(a1 + 64));
v47 = 0;
v27 = a1 + 64;
v28 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(v27) == 1 )
v15 = MmGetSessionIdEx(*((_QWORD *)v28 + 23));
--*((_WORD *)v28 + 243);
v29 = ++*((_BYTE *)v28 + 794);
v30 = (*((char *)v28 + 792) | *((char *)v28 + 870)) ^ 0x3F;
v19 = !_BitScanReverse((unsigned int *)&v31, v30);
if( v19 )
goto LABEL_54;
while( 1 )
{
v32 = *((_QWORD *)v28 + 100) + 96 * v31;
v30 &= ~(1 << v31);
if( (*(_BYTE *)(v32 + 26) & 1) != 0
&& (*(_DWORD *)(v32 + 32) & 1) == 0
&& (*(_QWORD *)(v32 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v20 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v32 + 40) == v15 )
{
*(_BYTE *)(v32 + 26) &= ~1u;
if( *(_QWORD *)(v32 + 32) )
break;
}
v19 = !_BitScanReverse((unsigned int *)&v31, v30);
if( v19 )
goto LABEL_54;
}
if( !v32 )
{
LABEL_54:
if( (*((_DWORD *)v28 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v28, v20, v15, 0i64);
}
else
{
*(_BYTE *)(v32 + 32) |= 2u;
if( *(__int64 *)(v32 + 32) < 0 )
KiAbEntryRemoveFromTree(v32);
v47 = *(_DWORD *)(v32 + 88) & 0x1FFFF;
*(_DWORD *)(v32 + 88) &= 0xFFFE0000;
*(_BYTE *)(v32 + 25) &= ~1u;
*(_QWORD *)(v32 + 32) = 0i64;
v33 = (__int64)(v32 - *((_QWORD *)v28 + 100)) / 96;
if( v29 == 1 )
*((_BYTE *)v28 + 792) |= 1 << v33;
else
_InterlockedOr8((volatile signed __int8 *)v28 + 870, 1 << v33);
}
--*((_BYTE *)v28 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v28, v20, (unsigned int *)&v47);
v19 = (*((_WORD *)v28 + 243))++ == 0xFFFF;
if( v19 && *((_ETHREAD **)v28 + 19) != (_ETHREAD *)((char *)v28 + 152) )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}
}
if( v18 > 1 )
{
v35 = (char *)(v11 + 56);
do
{
v35[7] = v4++;
v36 = *v35;
v35 += 32;
*(v35 - 32) = v36 | 1;
}
while( v4 < v18 );
}
return v11;
}Referenced by:
RtlpHpSegAlloc