ExpInsertPoolTrackerExpansion

VOID __stdcall ExpInsertPoolTrackerExpansion(UINT64 Key, UINT64 NumberOfBytes, POOL_TYPE PoolType){
  int v4; 
  char v5; 
  __int64 v6; 
  _DWORD *v7; 
  __int64 v8; 
  __int64 v9; 
  UINT8 *v10; 
  unsigned __int64 v11; 
  unsigned int v12; 
  __int64 v13; 
  int v14; 
  UINT8 *v15; 
  UINT8 *HeapPages; 
  UINT8 *v17; 
  __int64 v18; 
  __int64 v19; 
  int v20; 
  int v21; 
  unsigned int v22; 
  int v23; 
  int v24; 
  __int64 v25; 
  char *v26; 
  __int64 v27; 
  __int64 v28; 
  UINT8 *v29; 
  __int64 v30; 
  unsigned __int64 Size; 
  __int64 v32; 
  int v33; 
  __int64 v34; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  KLOCK_QUEUE_HANDLE v36; 
  unsigned int Keya; 
  int v39; 
  int v40; 
  Keya = Key;
  v4 = Key;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v5 = PoolType;
  KeAcquireInStackQueuedSpinLock(&ExpTaggedPoolLock, &LockHandle);
  v6 = 32i64;
  v39 = v5 & 0x20;
  if( (v5 & 0x20) != 0 )
  {
    v7 = (_DWORD *)ExpSessionPoolTrackTable;
    v8 = ExpSessionPoolTrackTableSize;
    v9 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64);
    v10 = *(UINT8 **)(v9 + 976);
    v11 = *(_QWORD *)(v9 + 984);
  }
  else
  {
    v7 = PoolTrackTable;
    v8 = PoolTrackTableSize;
    v11 = PoolTrackTableExpansionSize;
    v10 = PoolTrackTableExpansion;
  }
  v12 = 0;
  if( v11 )
  {
    v13 = 0i64;
    do
    {
      v14 = *(_DWORD *)&v10[56 * v13];
      if( v14 == v4 )
        break;
      if( !v14 )
      {
        *(_DWORD *)&v10[56 * v12] = v4;
        break;
      }
      v13 = ++v12;
    }
    while( v12 < v11 );
  }
  if( v12 != v11 )
  {
    v15 = &v10[56 * v12];
    if( (PoolType & 1) != 0 )
    {
      ++*((_QWORD *)v15 + 5);
      *((_QWORD *)v15 + 4) += NumberOfBytes;
    }
    else
    {
      ++*((_QWORD *)v15 + 2);
      *((_QWORD *)v15 + 1) += NumberOfBytes;
    }
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    return;
  }
  if( v7[14 * v8 - 14] )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    v26 = (char *)&v7[14 * (unsigned int)(v8 - 1)];
    if( (PoolType & 1) != 0 )
    {
      v27 = 40i64;
    }
    else
    {
      v6 = 8i64;
      v27 = 16i64;
    }
    _InterlockedIncrement64((volatile signed __int64 *)&v26[v27]);
    _InterlockedExchangeAdd64((volatile signed __int64 *)&v26[v6], NumberOfBytes);
    return;
  }
  v32 = 56 * v11;
  Size = (56 * v11 + 4095) & 0xFFFFFFFFFFFFF000ui64;
  HeapPages = (UINT8 *)ExAllocateHeapPages();
  v17 = HeapPages;
  if( !HeapPages )
  {
    v30 = 14i64 * (unsigned int)(v8 - 1);
    v7[v30] = 1818654287;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    if( (PoolType & 1) != 0 )
    {
      _InterlockedIncrement64((volatile signed __int64 *)&v7[v30 + 10]);
      _InterlockedExchangeAdd64((volatile signed __int64 *)&v7[v30 + 8], NumberOfBytes);
    }
    else
    {
      _InterlockedIncrement64((volatile signed __int64 *)&v7[v30 + 4]);
      _InterlockedExchangeAdd64((volatile signed __int64 *)&v7[v30 + 2], NumberOfBytes);
    }
    return;
  }
  if( v10 )
    memmove(HeapPages, v10, Size);
  memset((INT64)&v17[v32], 0i64);
  if( v39 )
  {
    v18 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64);
    *(_QWORD *)(v18 + 976) = v17;
    *(_QWORD *)(v18 + 984) = (Size + 4096) / 0x38;
  }
  else
  {
    PoolTrackTableExpansion = v17;
    PoolTrackTableExpansionSize = (Size + 4096) / 0x38;
  }
  memset(&v36, 0, sizeof(v36));
  if( PoolHitTag == 1819242320 )
    __debugbreak();
  v28 = HIDWORD(PerfGlobalGroupMask);
  LODWORD(v28) = *((_DWORD *)KeGetPcr() + 105);
  v23 = PoolTrackTableMask;
  v25 = PoolTrackTableSize;
  v22 = PoolTrackTableMask & 0x40DEDA5;
  v33 = PoolTrackTableMask;
  v29 = (&ExPoolTagTables)[v28];
  v24 = PoolTrackTableMask & 0x40DEDA5;
  v40 = PoolTrackTableMask & 0x40DEDA5;
  v34 = PoolTrackTableSize;
  do
  {
    while( 1 )
    {
      v19 = 56i64 * v22;
      v20 = *(_DWORD *)&v29[v19];
      if( v20 == 1819242320 )
      {
        _InterlockedIncrement64((volatile signed __int64 *)&v29[v19 + 16]);
        _InterlockedExchangeAdd64((volatile signed __int64 *)&v29[v19 + 8], Size + 4096);
        goto LABEL_25;
      }
      if( v20 )
        break;
      v21 = *(_DWORD *)((char *)PoolTrackTable + v19);
      if( v21 )
      {
        *(_DWORD *)&v29[v19] = v21;
      }
      else
      {
        if( v22 == v25 - 1 )
          break;
        KeAcquireInStackQueuedSpinLock(&ExpTaggedPoolLock, &v36);
        if( !*(_DWORD *)((char *)PoolTrackTable + v19) )
        {
          *(_DWORD *)((char *)PoolTrackTable + v19) = 1819242320;
          *(_DWORD *)&v29[v19] = 1819242320;
        }
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&v36);
        __writecr8(v36.OldIrql);
        v23 = v33;
        v24 = v40;
        v25 = v34;
      }
    }
    v22 = v23 & (v22 + 1);
  }
  while( v22 != v24 );
  ExpInsertPoolTrackerExpansion(0x6C6F6F50ui64, Size + 4096, NonPagedPoolNx);
LABEL_25:
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
  if( v10 )
    ExPoolCleanupExpansionTable(v10);
  ExpInsertPoolTrackerExpansion(Keya, NumberOfBytes, PoolType);
}

Referenced by: