ExAllocateHeapPool

VOID *__fastcall ExAllocateHeapPool(UINT64 PoolType, UINT64 NumberOfBytes, UINT64 Tag, UINT64 P2, UINT64 arg20){
  VOID *v5; 
  ULONG_PTR v6; 
  unsigned int v7; 
  unsigned int v8; 
  UINT64 v9; 
  int v10; 
  __int64 v11; 
  int v12; 
  char v13; 
  unsigned int v14; 
  __int64 *v15; 
  __int64 v16; 
  INT64 v17; 
  unsigned __int64 v18; 
  unsigned __int64 v19; 
  INT64 v20; 
  unsigned __int64 v21; 
  unsigned int v22; 
  __int64 v23; 
  int v24; 
  unsigned __int64 v25; 
  unsigned int v26; 
  unsigned int v27; 
  __int64 v28; 
  __int64 v29; 
  INT64 v30; 
  bool v31; 
  unsigned __int8 v32; 
  INT64 v33; 
  __int64 v34; 
  UINT64 Internal; 
  unsigned __int32 v36; 
  int v37; 
  int v38; 
  __int64 v39; 
  UINT8 *v40; 
  unsigned int v41; 
  unsigned int v42; 
  __int64 v43; 
  int v44; 
  volatile signed __int32 *v45; 
  __int64 v46; 
  __int64 v47; 
  __int64 v49; 
  unsigned int v50; 
  __int64 v51; 
  unsigned __int16 *v52; 
  unsigned int v53; 
  UINT64 v54; 
  __int64 v55; 
  unsigned __int64 v56; 
  INT64 v57; 
  __int64 v58; 
  unsigned __int64 v59; 
  int v60; 
  unsigned int v61; 
  int v62; 
  unsigned __int64 v63; 
  unsigned int v64; 
  UINT64 v65; 
  VOID *v66; 
  __int64 v67; 
  __int64 v68; 
  int v69; 
  __int64 v70; 
  UINT8 *v71; 
  unsigned int v72; 
  int v73; 
  __int64 v74; 
  int v75; 
  volatile signed __int32 *v76; 
  __int64 v77; 
  __int64 v78; 
  INT64 v79; 
  unsigned int v80; 
  unsigned int v81; 
  unsigned int v82; 
  unsigned int v83; 
  int v84; 
  struct _SLIST_ENTRY *v85; 
  UINT32 v86; 
  volatile signed __int32 v87; 
  BOOL updated; 
  UINT64 v89; 
  volatile signed __int32 v90; 
  unsigned __int64 v91; 
  UINT64 HeapSpecialPool; 
  INT64 v93; 
  INT64 v94; 
  unsigned __int64 v95; 
  INT64 v96; 
  INT64 v97; 
  UINT64 v98; 
  unsigned __int64 v99; 
  ULONG_PTR BugCheckParameter4; 
  PVOID Entry; 
  unsigned int Entrya; 
  int v103; 
  int v104; 
  __int64 v105; 
  __int64 v106; 
  UINT8 *v107; 
  INT64 *v108; 
  int v109; 
  __int64 v110; 
  int a6; 
  int v112; 
  __int64 a5; 
  INT64 v114; 
  __int64 v115; 
  PSLIST_ENTRY ListEnd; 
  KLOCK_QUEUE_HANDLE v117; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  INT64 v119[2]; 
  __int64 v120; 
  INT64 v121[2]; 
  __int64 v122; 
  __int64 v123; 
  __int64 v124; 
  VOID *retaddr; 
  unsigned int Taga; 
  v5 = 0i64;
  v6 = (unsigned int)P2;
  Entry = 0i64;
  v7 = ((unsigned int)PoolType >> 9) & 2;
  v8 = Tag;
  v9 = NumberOfBytes;
  v10 = PoolType;
  if( (PoolType & 0x44) == 68 )
    v10 = PoolType & 0xFFFFFFFB;
  v11 = 1i64;
  v12 = v10 | 0x200;
  if( (ExpPoolFlags & 0x400) == 0 || (v10 & 0x201) != 0 )
    v12 = v10;
  if( (ExpPoolFlags & 8) == 0 )
    goto LABEL_6;
  if( (v12 & 0x80000080) != 0 )
  {
    v12 &= ~0x80u;
    if( v12 < 0 )
    {
      v13 = arg20;
      if( (MmVerifierData & 1) != 0 )
        v13 = 1;
LABEL_7:
      v14 = v8 & 0x7FFFFFFF;
      Taga = v14;
      if( !v14 )
      {
        v14 = 811884866;
        Taga = 811884866;
      }
      if( NumberOfBytes <= 0xFE0
        && ((_DWORD)MmSpecialPoolTag
         && NumberOfBytes
         && ((unsigned int)ExCheckSingleFilter(v14, (unsigned int)MmSpecialPoolTag) || v91 >= v9 + 16 && v91 < v9 + 32)
         || ((unsigned __int8)v13 & (unsigned __int8)v11) != 0) )
      {
        HeapSpecialPool = ExAllocateHeapSpecialPool((unsigned int)v12, v9, v14);
        Entry = (PVOID)HeapSpecialPool;
        if( HeapSpecialPool )
        {
          if( _InterlockedIncrement(&ExpSpecialAllocations) == 1 )
            _InterlockedIncrement(&dword_140C4EC18);
          v5 = (VOID *)HeapSpecialPool;
          goto LABEL_65;
        }
        v11 = 1i64;
      }
      if( !v9 )
        v9 = v11;
      if( (_DWORD)v6 == 0x80000000 )
        goto LABEL_195;
      if( (unsigned int)v6 >= (unsigned __int16)KeNumberNodes )
        KeBugCheckEx(0xC2u, 0xEui64, v6, v12 & 0xFFFFFFFFFFFFFF7Fui64, v14);
      if( (_DWORD)v6 == 0x80000000 )
LABEL_195:
        LODWORD(v6) = *(unsigned __int16 *)(*((_QWORD *)KeGetCurrentPrcb() + 24) + 146i64);
      if( (unsigned int)v6 >= dword_140C57DD0 )
        LODWORD(v6) = 0;
      v15 = &qword_140C57E00[1048 * (unsigned int)v6];
      if( v12 < 0 )
      {
        v17 = v15[3];
      }
      else if( (v12 & 0x21) == 33 )
      {
        v17 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64) + 672i64) + 14560i64);
      }
      else
      {
        if( (v12 & 1) != 0 )
        {
          v16 = 2i64;
        }
        else
        {
          v16 = 0i64;
          if( (v12 & 0x200) != 0 )
            v16 = v11;
        }
        v17 = v15[v16];
      }
      if( v9 <= 0xFE0 )
      {
        v18 = v9 + 16;
        if( (v12 & 4) != 0 )
        {
          v18 += *(unsigned int *)((char *)&Mm64BitPhysicalAddress + 7);
          if( v18 > 0xFE0 )
          {
            v18 -= *(unsigned int *)((char *)&Mm64BitPhysicalAddress + 7);
            LOWORD(v12) = v12 & 0xFFFB;
          }
        }
        v19 = (v18 + 15) & 0xFFFFFFFFFFFFFFF0ui64;
        if( v19 < 0x201 )
          goto LABEL_27;
        if( v19 > 0xF80 )
          goto LABEL_27;
        v49 = *((unsigned __int8 *)RtlpLfhBucketIndexMap + ((unsigned int)v19 >> 4));
        v19 = (unsigned __int16)RtlpBucketBlockSizes[v49];
        v50 = v49 - 33;
        v51 = *(_QWORD *)(v17 + 40);
        if( !v51 )
          goto LABEL_27;
        v52 = (unsigned __int16 *)(v51 + ((v50 + 1i64) << 6));
        ++*((_DWORD *)v52 + 5);
        if( !*v52 || (Internal = (UINT64)RtlpInterlockedPopEntrySList((PSLIST_HEADER)(v51 + ((v50 + 1i64) << 6)))) == 0 )
        {
          ++*((_DWORD *)v52 + 6);
          Internal = 0i64;
        }
        if( !Internal )
        {
          v80 = v52[8];
          v81 = *v52;
          v114 = 0i64;
          ListEnd = 0i64;
          v82 = 0;
          if( v81 < v80 )
            v82 = v80 - v81;
          v83 = v82 >> 1;
          if( v83 )
          {
            v84 = RtlpHpVsContextMultiAlloc(
                    (INT64 *)(v17 + 640),
                    (unsigned int)v19,
                    v83 + 1,
                    0i64,
                    (INT64)&v114,
                    (INT64)&ListEnd);
            if( v84 )
            {
              Internal = v114;
              v85 = *(struct _SLIST_ENTRY **)v114;
              v114 = *(_QWORD *)v114;
              v86 = v84 - 1;
              if( v86 )
                InterlockedPushListSList((PSLIST_HEADER)v52, v85, ListEnd, v86);
            }
            else
            {
              Internal = 0i64;
            }
          }
          else
          {
            Internal = 0i64;
          }
        }
        if( (v12 & 0x400) != 0 )
        {
          if( !Internal )
          {
LABEL_80:
            v11 = 1i64;
LABEL_27:
            v20 = *(_QWORD *)(v17 + 48);
            v21 = v20;
            v22 = (v7 | *(_DWORD *)(v17 + 20)) & 0x93000F0B;
            if( (v20 || (v21 = qword_140C1DC28) != 0) && v19 > v21 )
            {
              v96 = *(_QWORD *)(v17 + 56);
              if( v96 )
                RtlpLogHeapFailure(20i64, v17, 0i64, v96, v19, v20);
              goto LABEL_175;
            }
            v103 = 0;
            v23 = 0i64;
            v115 = 0i64;
            if( (v22 & 0x1000000) != 0 )
              goto LABEL_31;
            v24 = *(_DWORD *)(v17 + 24);
            v103 = v24;
            if( !v24 )
              goto LABEL_31;
            v22 |= 8u;
            if( (_WORD)v24 == 1
              && (int)((__int64(__fastcall *)(INT64, _QWORD, _QWORD, __int64 *))RtlpInterceptorRoutines)(
                        v17,
                        0i64,
                        (unsigned int)v11,
                        &v115) >= 0 )
            {
              v23 = v115;
              v11 = 1i64;
LABEL_31:
              v25 = v23 + v19;
              if( (v22 & 0x10000000) != 0 )
                v25 += 16i64;
              if( (v22 & 0x20000F08) != 0 )
                v25 = ((v25 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 16;
              if( !v25 )
                v25 = v11;
              if( v25 < v19 || v19 > 0x7FFFFFFFFFFFFFFFi64 )
              {
                Internal = 0i64;
              }
              else
              {
                v26 = v22 & 0x13000003;
                if( v25 > (unsigned int)*(unsigned __int16 *)(v17 + 892) - 16 )
                  goto LABEL_124;
                v27 = v25;
                if( (_DWORD)v19 != (_DWORD)v25 )
                  v27 = v25 + 2;
                v108 = (INT64 *)(v17
                               + 832
                               + 8 * (*((unsigned __int8 *)RtlpLfhBucketIndexMap + ((v27 + 15) >> 4)) + 16i64));
                if( (*v108 & 1) == 0
                  || (updated = RtlpHpLfhBucketUpdateStats(v17 + 832, v27, (unsigned int)v11),
                      v26 = v22 & 0x13000003,
                      updated) )
                {
                  v28 = 128i64;
                  v29 = *(unsigned __int8 *)(v17 + 888);
                  v30 = *v108;
                  if( (RtlpHpLfhPerfFlags & 0x400) != 0 )
                    v28 = 192i64;
                  v123 = v28;
                  v31 = *(_BYTE *)(v30 + 2) == 1;
                  v124 = v28 + v29 - (((_BYTE)v29 - 1) & 7) + 7;
                  if( v31 )
                    v32 = 0;
                  else
                    v32 = *(_BYTE *)(*((unsigned __int8 *)KeGetCurrentThread() + 1573) + v28 + v30);
                  LODWORD(BugCheckParameter4) = v26;
                  v33 = RtlpHpLfhSlotAllocate(
                          v17 + 832,
                          v30,
                          *(_QWORD *)(v28 + v29 - (((_BYTE)v29 - 1) & 7) + 7 + v30 + 8i64 * v32),
                          (unsigned int)v19,
                          BugCheckParameter4);
                  v26 = v22 & 0x13000003;
                  Internal = v33;
                  if( v33 && (v22 & 2) != 0 )
                  {
                    memset(v33, 0i64);
                    v26 = v22 & 0x13000003;
                  }
                }
                else
                {
                  Internal = -1i64;
                }
                if( Internal == -1i64 )
                {
LABEL_124:
                  if( v25 > 0x20000 )
                  {
                    if( v25 > *(unsigned int *)(v17 + 464) )
                    {
                      v98 = RtlpHpLargeAlloc(v17, v19, v25, v26);
                    }
                    else
                    {
                      v97 = v17 + 256;
                      if( v25 > *(unsigned int *)(v17 + 272) )
                        v97 = v17 + 448;
                      LODWORD(BugCheckParameter4) = v26;
                      v98 = RtlpHpSegAlloc(v97, v19, v25, v25, BugCheckParameter4);
                    }
                    Internal = v98;
                  }
                  else
                  {
                    v112 = 0;
                    v122 = 0i64;
                    *(_OWORD *)v121 = 0i64;
                    Internal = (UINT64)RtlpHpVsContextAllocateInternal(
                                         (INT64 *)(v17 + 640),
                                         (unsigned int)v19,
                                         (unsigned int)v25,
                                         v26,
                                         (INT64)v121,
                                         (INT64)&v112);
                    if( v112 && (v22 & 1) == 0 )
                      RtlpHpReleaseQueuedLockExclusive(*(unsigned int *)(v17 + 648), (INT64)v121);
                  }
                }
                if( !Internal )
                  goto LABEL_175;
                if( (v22 & 0x30000F08) != 0 )
                {
                  v99 = RtlpHpExtrasAppend((__int128 *)v17, Internal, v19, v34, v115, v22, 0);
                  if( v103 )
                  {
                    *(_BYTE *)(v99 + 2) ^= (*(_BYTE *)(v99 + 2) ^ v103) & 0xF;
                    if( (_WORD)v103 != 1
                      || (int)((__int64(__fastcall *)(INT64, UINT64, __int64, unsigned __int64))RtlpInterceptorRoutines)(
                                v17,
                                Internal,
                                2i64,
                                v99 + 16) < 0 )
                    {
                      RtlpHpFreeHeap((PVOID)v17, (PVOID)Internal, v22);
                      goto LABEL_175;
                    }
                  }
                }
              }
              if( !Internal )
                goto LABEL_175;
              goto LABEL_54;
            }
LABEL_175:
            if( Entry )
              RtlpHpFreeHeap((PVOID)v17, Entry, 0i64);
            goto LABEL_229;
          }
          memset(Internal, 0i64);
        }
        if( Internal )
        {
LABEL_54:
          v36 = Taga;
          *(_BYTE *)(Internal + 2) = v19 >> 4;
          *(_DWORD *)(Internal + 4) = Taga;
          *(_BYTE *)Internal = 0;
          *(_QWORD *)&LockHandle.OldIrql = 0i64;
          *(_BYTE *)(Internal + 3) = v12 & 0x6D | 2;
          LockHandle.LockQueue = 0i64;
          if( Taga == PoolHitTag )
            __debugbreak();
          v37 = v12 & 0x20;
          if( (v12 & 0x20) != 0 )
          {
            v40 = (UINT8 *)ExpSessionPoolTrackTable;
            v38 = ExpSessionPoolTrackTableMask;
            v39 = ExpSessionPoolTrackTableSize;
          }
          else
          {
            v38 = PoolTrackTableMask;
            v39 = PoolTrackTableSize;
            v40 = (&ExPoolTagTables)[*((unsigned int *)KeGetPcr() + 105)];
          }
          v106 = v39;
          v109 = v38;
          v41 = v38 & ((40543 * Taga) ^ ((40543 * (unsigned __int64)Taga) >> 32));
          v42 = v41;
          Entrya = v41;
          while( 1 )
          {
            while( 1 )
            {
              while( 1 )
              {
                v43 = 56i64 * v41;
                v44 = *(_DWORD *)&v40[v43];
                v45 = (volatile signed __int32 *)&v40[v43];
                if( v44 == v36 )
                {
                  if( (v12 & 1) != 0 )
                  {
                    v46 = 8i64;
                    v47 = 10i64;
                  }
                  else
                  {
                    v46 = 2i64;
                    v47 = 4i64;
                  }
                  _InterlockedIncrement64((volatile signed __int64 *)&v45[v47]);
                  _InterlockedExchangeAdd64((volatile signed __int64 *)&v45[v46], v19);
LABEL_63:
                  if( (v12 & 4) != 0 )
                  {
                    *(_BYTE *)(Internal + 3) &= ~4u;
                    v53 = (*(_DWORD *)((char *)&Mm64BitPhysicalAddress + 7) - 1) & (-16 - Internal);
                    if( v53 )
                    {
                      v54 = Internal + v53;
                      v55 = (__int64)v53 >> 4;
                      *(_BYTE *)v54 = v55;
                      *(_BYTE *)(v54 + 2) = *(_BYTE *)(Internal + 2) - v55;
                      *(_BYTE *)(v54 + 1) = *(_BYTE *)(Internal + 1);
                      *(_BYTE *)(v54 + 3) = *(_BYTE *)(Internal + 3) | 4;
                      *(_DWORD *)(v54 + 4) = *(_DWORD *)(Internal + 4);
                      if( (unsigned __int8)*(_WORD *)v54 > 1u )
                        *(_QWORD *)(Internal + 16) = ExpPoolQuotaCookie ^ v54;
                      Internal = v54;
                    }
                  }
                  v5 = (VOID *)(Internal + 16);
LABEL_65:
                  if( v5 )
                    return v5;
LABEL_229:
                  if( (v12 & 0x10) != 0 )
                    RtlRaiseStatus(-1073741670);
                  return v5;
                }
                if( !v44 )
                  break;
LABEL_70:
                v41 = v38 & (v41 + 1);
                if( v41 == v42 )
                {
                  ExpInsertPoolTrackerExpansion(v36, v19, (POOL_TYPE)(v12 & 0x6D | 2));
                  goto LABEL_63;
                }
              }
              if( !v37 )
                break;
LABEL_147:
              if( v41 == v39 - 1 )
                goto LABEL_70;
              if( v37 )
              {
                _InterlockedCompareExchange(v45, v36, 0);
              }
              else
              {
                KeAcquireInStackQueuedSpinLock(&ExpTaggedPoolLock, &LockHandle);
                if( !*((_DWORD *)PoolTrackTable + 14 * v41) )
                {
                  *((_DWORD *)PoolTrackTable + 14 * v41) = Taga;
                  *v45 = Taga;
                }
                KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
                __writecr8(LockHandle.OldIrql);
                v37 = v12 & 0x20;
                v36 = Taga;
                v38 = v109;
                v42 = Entrya;
                v39 = v106;
              }
            }
            v87 = *(_DWORD *)((char *)PoolTrackTable + v43);
            if( !v87 )
            {
              v39 = v106;
              goto LABEL_147;
            }
            *v45 = v87;
            v39 = v106;
          }
        }
        goto LABEL_80;
      }
      v56 = (v9 + 15) & 0xFFFFFFFFFFFFFFF0ui64;
      if( v56 >= 0x10000 || (((_WORD)v9 + 15) & 0xFF0u) > 0xFC0 )
        v56 = (v56 + 4095) & 0xFFFFFFFFFFFFF000ui64;
      if( v56 < v9 )
        goto LABEL_175;
      if( (v56 & 0xFFF) == 0 && v56 <= *(unsigned int *)(v17 + 464) )
      {
        v79 = v17 + 256;
        if( v56 > *(unsigned int *)(v17 + 272) )
          v79 = v17 + 448;
        LODWORD(BugCheckParameter4) = ((unsigned int)v12 >> 9) & 2;
        v66 = (VOID *)RtlpHpSegAlloc(v79, v56, v56, v56, BugCheckParameter4);
        Entry = v66;
        goto LABEL_112;
      }
      v57 = *(_QWORD *)(v17 + 48);
      v58 = 0i64;
      v59 = v57;
      v60 = v7 | *(_DWORD *)(v17 + 20);
      a5 = 0i64;
      v61 = v60 & 0x93000F0B;
      if( (v57 || (v59 = qword_140C1DC28) != 0) && v56 > v59 )
      {
        v93 = *(_QWORD *)(v17 + 56);
        if( v93 )
          RtlpLogHeapFailure(20i64, v17, 0i64, v93, v56, v57);
        goto LABEL_173;
      }
      v104 = 0;
      if( (v61 & 0x1000000) == 0 )
      {
        v62 = *(_DWORD *)(v17 + 24);
        v104 = v62;
        if( v62 )
        {
          v61 |= 8u;
          if( (_WORD)v62 != 1
            || (int)((__int64(__fastcall *)(INT64, _QWORD, _QWORD, __int64 *))RtlpInterceptorRoutines)(
                      v17,
                      0i64,
                      (unsigned int)v11,
                      &a5) < 0 )
          {
LABEL_173:
            v66 = 0i64;
            Entry = 0i64;
LABEL_112:
            if( !v66 )
              goto LABEL_229;
            LOWORD(BugCheckParameter4) = 0;
            if( !(unsigned int)ExpAddTagForBigPages(v66, v14, v56, (POOL_TYPE)v12, BugCheckParameter4, 0) )
              goto LABEL_175;
            memset(&v117, 0, sizeof(v117));
            if( v14 == PoolHitTag )
              __debugbreak();
            v68 = HIDWORD(PerfGlobalGroupMask);
            if( (v12 & 0x20) != 0 )
            {
              v71 = (UINT8 *)ExpSessionPoolTrackTable;
              v69 = ExpSessionPoolTrackTableMask;
              v70 = ExpSessionPoolTrackTableSize;
            }
            else
            {
              LODWORD(v68) = *((_DWORD *)KeGetPcr() + 105);
              v69 = PoolTrackTableMask;
              v70 = PoolTrackTableSize;
              v71 = (&ExPoolTagTables)[v68];
            }
            v105 = v70;
            v107 = v71;
            v72 = v69 & ((40543 * v14) ^ ((40543 * (unsigned __int64)v14) >> 32));
            v73 = v72;
            while( 1 )
            {
              v74 = 56i64 * v72;
              v75 = *(_DWORD *)&v71[v74];
              v76 = (volatile signed __int32 *)&v71[v74];
              v110 = v74;
              if( v75 == v14 )
              {
                if( (v12 & 1) != 0 )
                {
                  v77 = 8i64;
                  v78 = 10i64;
                }
                else
                {
                  v77 = 2i64;
                  v78 = 4i64;
                }
                _InterlockedIncrement64((volatile signed __int64 *)&v76[v78]);
                _InterlockedExchangeAdd64((volatile signed __int64 *)&v76[v77], v56);
                v5 = Entry;
                goto LABEL_65;
              }
              if( v75 )
              {
LABEL_139:
                v72 = v69 & (v72 + 1);
                if( v72 == v73 )
                {
                  ExpInsertPoolTrackerExpansion(v14, v56, (POOL_TYPE)v12);
                  v5 = Entry;
                  goto LABEL_65;
                }
              }
              else if( (v12 & 0x20) != 0 || (v90 = *(_DWORD *)((char *)PoolTrackTable + v74)) == 0 )
              {
                if( v72 == v70 - 1 )
                  goto LABEL_139;
                if( (v12 & 0x20) != 0 )
                {
                  _InterlockedCompareExchange(v76, v14, 0);
                }
                else
                {
                  KeAcquireInStackQueuedSpinLock(&ExpTaggedPoolLock, &v117);
                  if( !*(_DWORD *)((char *)PoolTrackTable + v110) )
                  {
                    *(_DWORD *)((char *)PoolTrackTable + v110) = v14;
                    *v76 = v14;
                  }
                  KeReleaseInStackQueuedSpinLockFromDpcLevel(&v117);
                  __writecr8(v117.OldIrql);
                  v71 = v107;
                  v73 = v69 & ((40543 * v14) ^ ((40543 * (unsigned __int64)v14) >> 32));
                  v70 = v105;
                }
              }
              else
              {
                *v76 = v90;
              }
            }
          }
          v58 = a5;
          v11 = 1i64;
        }
      }
      v63 = v58 + v56;
      if( (v61 & 0x10000000) != 0 )
        v63 += 16i64;
      if( (v61 & 0x20000F08) != 0 )
        v63 = ((v63 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 16;
      if( !v63 )
        v63 = v11;
      if( v63 < v56 || v56 > 0x7FFFFFFFFFFFFFFFi64 )
        goto LABEL_173;
      v64 = v61 & 0x13000003;
      v65 = (unsigned int)v63;
      if( v63 <= (unsigned int)*(unsigned __int16 *)(v17 + 892) - 16 )
      {
        Entry = (PVOID)RtlpHpLfhContextAllocate(v17 + 832, (unsigned int)v56, (unsigned int)v63, v64);
        v66 = Entry;
        v65 = (unsigned int)v63;
        if( Entry != (PVOID)-1i64 )
        {
LABEL_110:
          if( v66 && (v61 & 0x30000F08) != 0 )
          {
            v95 = RtlpHpExtrasAppend((__int128 *)v17, (UINT64)v66, v56, v67, a5, v61, 0);
            if( v104 )
            {
              *(_BYTE *)(v95 + 2) ^= (*(_BYTE *)(v95 + 2) ^ v104) & 0xF;
              if( (_WORD)v104 == 1
                && (int)((__int64(__fastcall *)(INT64, PVOID, __int64, unsigned __int64))RtlpInterceptorRoutines)(
                          v17,
                          Entry,
                          2i64,
                          v95 + 16) >= 0 )
              {
                v66 = Entry;
              }
              else
              {
                BugCheckParameter4 = 0i64;
                RtlpHpFreeHeap((PVOID)v17, Entry, v61);
                v66 = 0i64;
                Entry = 0i64;
              }
            }
            else
            {
              v66 = Entry;
            }
          }
          goto LABEL_112;
        }
        v64 = v61 & 0x13000003;
      }
      if( v63 > 0x20000 )
      {
        if( v63 <= *(unsigned int *)(v17 + 464) )
        {
          v94 = v17 + 256;
          if( v63 > *(unsigned int *)(v17 + 272) )
            v94 = v17 + 448;
          LODWORD(BugCheckParameter4) = v64;
          v89 = RtlpHpSegAlloc(v94, v56, v63, v63, BugCheckParameter4);
        }
        else
        {
          v89 = RtlpHpLargeAlloc(v17, v56, v63, v64);
        }
        Entry = (PVOID)v89;
        v66 = (VOID *)v89;
      }
      else
      {
        a6 = 0;
        v120 = 0i64;
        *(_OWORD *)v119 = 0i64;
        v66 = RtlpHpVsContextAllocateInternal(
                (INT64 *)(v17 + 640),
                (unsigned int)v56,
                v65,
                v64,
                (INT64)v119,
                (INT64)&a6);
        Entry = v66;
        if( a6 && (v61 & 1) == 0 )
        {
          RtlpHpReleaseQueuedLockExclusive(*(unsigned int *)(v17 + 648), (INT64)v119);
          v66 = Entry;
        }
      }
      goto LABEL_110;
    }
LABEL_6:
    v13 = arg20;
    goto LABEL_7;
  }
  return VeAllocatePoolWithTagPriority((_POOL_TYPE)v12, NumberOfBytes, v8, HighPoolPriority, retaddr);
}

Referenced by:

ExAllocatePoolWithTag
ExpAllocatePoolWithTagFromNode