HvFreeCell

VOID __fastcall HvFreeCell(UINT64 P2, UINT64 P3){
  volatile INT64 *v2; 
  ULONG_PTR v3; 
  __int64 v5; 
  INT64 CellMap; 
  _QWORD *v7; 
  __int64 v8; 
  unsigned int v9; 
  _DWORD *v10; 
  INT64 *v11; 
  unsigned int v12; 
  INT64 *v13; 
  int v14; 
  __int64 v15; 
  int v16; 
  int v17; 
  __int64 v18; 
  INT64 v19; 
  unsigned int v20; 
  unsigned int v21; 
  unsigned int v22; 
  unsigned int v23; 
  INT64 v24; 
  int v25; 
  ULONG_PTR BugCheckParameter4; 
  int BugCheckParameter3[18]; 
  INT64 *a4; 
  int v29; 
  a4 = 0i64;
  v2 = (volatile INT64 *)(P2 + 80);
  v3 = (unsigned int)P3;
  v5 = 0i64;
  ExAcquirePushLockExclusiveEx(P2 + 80, 0i64);
  CellMap = HvpGetCellMap(P2, (unsigned int)v3);
  v7 = (_QWORD *)CellMap;
  if( !CellMap )
    KeBugCheckEx(0x51u, 1ui64, P2, v3, 0x629ui64);
  v8 = *(_QWORD *)(CellMap + 8);
  v9 = (unsigned int)v3 >> 31;
  v10 = (_DWORD *)(v8 & 0xFFFFFFFFFFFFFFF0ui64);
  if( (v8 & 4) != 0 )
  {
    v22 = *(_DWORD *)((v8 & 0xFFFFFFFFFFFFFFF0ui64) + 4);
    v23 = v22 + *(_DWORD *)((v8 & 0xFFFFFFFFFFFFFFF0ui64) + 8);
    while( v22 < v23 )
    {
      v24 = HvpGetCellMap(P2, v22);
      *(_QWORD *)(v24 + 8) &= ~4ui64;
      v22 = v25 + 4096;
    }
  }
  v11 = (INT64 *)((char *)v10 + *v7 + (v3 & 0xFFF));
  *(_DWORD *)v11 = -*(_DWORD *)v11;
  do
  {
    LODWORD(BugCheckParameter4) = (unsigned int)v3 >> 31;
    if( HvpIsFreeNeighbor(P2, v10, v11, &a4, BugCheckParameter4) != 1 )
      break;
    v13 = a4;
    v14 = *(_DWORD *)v11;
    v15 = (unsigned int)v5;
    v5 = (unsigned int)(v5 + 1);
    v16 = *(_DWORD *)a4;
    if( a4 <= v11 )
    {
      *(_DWORD *)a4 = v16 + v14;
      v17 = v3 - v16;
      v11 = v13;
    }
    else
    {
      *(_DWORD *)v11 = v14 + v16;
      v17 = v14 + v3;
    }
    *(&v29 + v15) = v16;
    BugCheckParameter3[v15] = v17;
  }
  while( (unsigned int)v5 < 2 );
  v12 = (_DWORD)v11 + v10[1] + (v9 << 31) - (_DWORD)v10;
  if( (_DWORD)v5 )
  {
    v18 = 0i64;
    do
    {
      v19 = (*(unsigned int *)((char *)&v29 + v18 * 4) >> 3) - 1;
      if( (unsigned int)v19 >= 0x10 )
      {
        v20 = (unsigned int)v19 >> 4;
        if( v20 > 0xFF )
        {
          v19 = 23i64;
        }
        else
        {
          _BitScanReverse(&v21, v20);
          v19 = v21 + 16;
        }
      }
      LODWORD(BugCheckParameter4) = v12;
      HvpRemoveFreeCellHint(P2, (unsigned int)BugCheckParameter3[v18++], v19, v9, BugCheckParameter4);
      --v5;
    }
    while( v5 );
  }
  HvpEnlistFreeCell(P2);
  if( (_InterlockedExchangeAdd64(v2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v2);
  KeAbPostRelease((PVOID)v2);
}

Referenced by: