RtlpHpSegPageRangeShrink

CHAR __fastcall RtlpHpSegPageRangeShrink(INT64 a1, INT64 a2, INT64 a3, CHAR a4){
  int v4; 
  UINT8 CurrentIrql; 
  unsigned int v9; 
  INT64 v10; 
  UINT64 v11; 
  char v12; 
  unsigned __int64 v13; 
  char v14; 
  unsigned __int64 v15; 
  bool v16; 
  unsigned __int64 v17; 
  _QWORD *v18; 
  char *v19; 
  __int64 v20; 
  char v21; 
  _ETHREAD *v22; 
  unsigned int SessionId; 
  char v24; 
  int v25; 
  bool v26; 
  __int64 v27; 
  unsigned __int64 v28; 
  __int64 v29; 
  _ETHREAD *CurrentThread; 
  __int64 v31; 
  UINT64 *BugCheckParameter4; 
  int v34; 
  int v35; 
  int v36; 
  v35 = a3;
  v4 = *(unsigned __int8 *)(a2 + 31);
  if( (unsigned int)(v4 - 1) > 1 )
  {
    v19 = (char *)(a2 + 56);
    v20 = (unsigned int)(v4 - 2);
    do
    {
      v21 = *v19;
      v19 += 32;
      *(v19 - 32) = v21 & 0xFE;
      --v20;
    }
    while( v20 );
  }
  CurrentIrql = -1;
  if( (a4 & 1) == 0 )
  {
    if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
    {
      CurrentIrql = KeGetCurrentIrql();
      __writecr8(2ui64);
      ExpAcquireSpinLockExclusive((INT64 *)(a1 + 64), CurrentIrql);
    }
    else
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 243);
      ExAcquirePushLockExclusiveEx(a1 + 64, 0i64);
    }
  }
  v9 = *(_DWORD *)(a2 + 28);
  LOBYTE(v35) = CurrentIrql;
  if( HIBYTE(v9) != v4 )
  {
    *(_BYTE *)(a2 + 31) = 0;
    *(_WORD *)(a2 + 28) = -1;
  }
  *(_BYTE *)(a2 + 24) |= 2u;
  *(_BYTE *)(32i64 * (unsigned int)(v4 - 1) + a2 + 31) = v4 - 1;
  *(_WORD *)(a2 + 28) = v9;
  *(_BYTE *)(a2 + 31) = v4;
  *(_DWORD *)a2 = -857879331;
  *(_BYTE *)(a2 + 24) &= 0xF3u;
  v10 = RtlpHpSegPageRangeCoalesce(a1, a2, a4, 0i64, (CHAR *)&v35);
  v12 = *(_BYTE *)(a1 + 13);
  v13 = v10;
  if( (v12 & 0x10) != 0
    && (LODWORD(v10) = *(unsigned __int8 *)(v10 + 31), (_DWORD)v10 == 256 - *(unsigned __int8 *)(a1 + 10)) )
  {
    v18 = (_QWORD *)(v13 & *(_QWORD *)a1);
    *(_DWORD *)v13 = -857879297;
    if( v18 )
    {
      v31 = *v18;
      v10 = v18[1];
      if( *(_QWORD **)(*v18 + 8i64) != v18 || *(_QWORD **)v10 != v18 )
        __fastfail(3u);
      *(_QWORD *)v10 = v31;
      *(_QWORD *)(v31 + 8) = v10;
      --*(_QWORD *)(a1 + 88);
    }
  }
  else
  {
    if( (v12 & 7) != 0 )
      v14 = RtlpHpSegPageRangeComputeLargePageCost(
              (PVOID)a1,
              (THREADINFOCLASS)(((__int64)(v13 - (v13 & *(_QWORD *)a1)) >> 5 << *(_BYTE *)(a1 + 8))
                              + (v13 & *(_DWORD *)a1)),
              (PVOID)(*(unsigned __int8 *)(v13 + 31) << *(_BYTE *)(a1 + 8)),
              v11,
              BugCheckParameter4);
    else
      v14 = 4;
    *(_BYTE *)(v13 + 30) = v14;
    v15 = *(_QWORD *)(a1 + 96);
    if( (*(_QWORD *)(a1 + 104) & 1) != 0 )
    {
      if( v15 )
        v15 ^= a1 + 96;
      else
        v15 = 0i64;
    }
    v16 = 0;
    if( v15 )
    {
      while( 1 )
      {
        if( *(_DWORD *)(v13 + 28) < *(_DWORD *)(v15 + 28) )
        {
          v17 = *(_QWORD *)v15;
          if( (*(_QWORD *)(a1 + 104) & 1) != 0 )
          {
            if( !v17 )
              goto LABEL_25;
            v17 ^= v15;
          }
          if( !v17 )
          {
LABEL_25:
            v16 = 0;
            break;
          }
        }
        else
        {
          v17 = *(_QWORD *)(v15 + 8);
          if( (*(_QWORD *)(a1 + 104) & 1) != 0 )
          {
            if( !v17 )
              goto LABEL_26;
            v17 ^= v15;
          }
          if( !v17 )
          {
LABEL_26:
            v16 = 1;
            break;
          }
        }
        v15 = v17;
      }
    }
    RtlRbInsertNodeEx((unsigned __int64 *)(a1 + 96), v15, v16, v13);
    v10 = *(__int16 *)(a1 + 22);
    _InterlockedExchangeAdd64((volatile signed __int64 *)(v10 + a1 + 16), (unsigned __int16)~*(_WORD *)(v13 + 28));
    v18 = 0i64;
  }
  if( (a4 & 1) == 0 )
  {
    if( (*(_DWORD *)(a1 + 40) & 1) != 0 )
    {
      *(_DWORD *)(a1 + 64) = 0;
      LOBYTE(v10) = v35;
      __writecr8((unsigned __int8)v35);
    }
    else
    {
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 64), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)(a1 + 64));
      v34 = 0;
      v22 = (_ETHREAD *)KeGetCurrentThread();
      if( (unsigned int)MiGetSystemRegionType(a1 + 64) == 1 )
        SessionId = MmGetSessionIdEx(*((_QWORD *)v22 + 23));
      else
        SessionId = -1;
      --*((_WORD *)v22 + 243);
      v24 = ++*((_BYTE *)v22 + 794);
      v25 = (*((char *)v22 + 792) | *((char *)v22 + 870)) ^ 0x3F;
      v26 = !_BitScanReverse((unsigned int *)&v27, v25);
      v36 = v27;
      if( v26 )
        goto LABEL_59;
      while( 1 )
      {
        v28 = *((_QWORD *)v22 + 100) + 96 * v27;
        v25 &= ~(1 << v27);
        if( (*(_BYTE *)(v28 + 26) & 1) != 0
          && (*(_DWORD *)(v28 + 32) & 1) == 0
          && (*(_QWORD *)(v28 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((a1 + 64) & 0x7FFFFFFFFFFFFFFCi64)
          && *(_DWORD *)(v28 + 40) == SessionId )
        {
          *(_BYTE *)(v28 + 26) &= ~1u;
          if( *(_QWORD *)(v28 + 32) )
            break;
        }
        v26 = !_BitScanReverse((unsigned int *)&v27, v25);
        v36 = v27;
        if( v26 )
          goto LABEL_59;
      }
      if( !v28 )
      {
LABEL_59:
        if( (*((_DWORD *)v22 + 30) & 0x10000) == 0 )
          KeBugCheckEx(0x162u, (ULONG_PTR)v22, a1 + 64, SessionId, 0i64);
      }
      else
      {
        *(_BYTE *)(v28 + 32) |= 2u;
        if( *(__int64 *)(v28 + 32) < 0 )
          KiAbEntryRemoveFromTree(v28);
        v34 = *(_DWORD *)(v28 + 88) & 0x1FFFF;
        *(_DWORD *)(v28 + 88) &= 0xFFFE0000;
        *(_BYTE *)(v28 + 25) &= ~1u;
        *(_QWORD *)(v28 + 32) = 0i64;
        v29 = (__int64)(v28 - *((_QWORD *)v22 + 100)) / 96;
        if( v24 == 1 )
          *((_BYTE *)v22 + 792) |= 1 << v29;
        else
          _InterlockedOr8((volatile signed __int8 *)v22 + 870, 1 << v29);
      }
      --*((_BYTE *)v22 + 794);
      KiAbThreadRemoveBoosts((ULONG_PTR)v22, a1 + 64, (unsigned int *)&v34);
      v26 = (*((_WORD *)v22 + 243))++ == 0xFFFF;
      if( v26 && *((_ETHREAD **)v22 + 19) != (_ETHREAD *)((char *)v22 + 152) )
        KiCheckForKernelApcDelivery();
      LOBYTE(v10) = KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    }
  }
  if( v18 )
    LOBYTE(v10) = RtlpHpSegSegmentFree(a1, (INT64)v18, 0x7FFFFFFFi64, 1i64);
  return v10;
}

Referenced by: