MiOffsetToProtos

_SUBSECTION *__stdcall MiOffsetToProtos(_CONTROL_AREA *ControlArea, UINT64 SectionByteOffset, UINT64 *PteOffset){
  _SUBSECTION *v4; 
  UINT64 v6; 
  union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v8; 
  unsigned __int8 v9; 
  __int64 v10; 
  __int64 i; 
  unsigned __int64 v12; 
  UINT8 CurrentIrql; 
  int v14; 
  unsigned __int64 NumberOfPfnReferences; 
  UINT64 v16; 
  unsigned __int64 v17; 
  UINT64 v18; 
  UINT64 v19; 
  _QWORD *v21; 
  unsigned __int16 v22; 
  UINT64 j; 
  unsigned __int64 v24; 
  unsigned __int64 v25; 
  unsigned __int64 v26; 
  int v27[36]; 

  v4 = 0i64;
  v6 = SectionByteOffset >> 12;
  *PteOffset = SectionByteOffset >> 12;
  v8.LongFlags = (unsigned int)ControlArea->u;
  if( (v8.LongFlags & 0x20) != 0 || !ControlArea->FilePointer.Value || (v8.LongFlags & 0x400) != 0 )
  {
    v12 = ControlArea->Segment->TotalNumberOfPtes | ((unsigned __int64)(ControlArea->Segment->SegmentFlags.Short0 & 0x3FF) << 32);
  }
  else
  {
    v9 = ExAcquireSpinLockShared((INT64 *)&ControlArea->ControlAreaLock);
    v10 = *(_QWORD *)&ControlArea[2].gap8[8];
    for( i = 0i64; v10; v10 = *(_QWORD *)(v10 + 8) )
      i = v10;
    v12 = (*(unsigned int *)(i - 20) | ((unsigned __int64)(*(_WORD *)(i - 24) & 0xFFC0) << 26))
        + *(unsigned int *)(i - 12)
        - (unsigned __int64)(*(_DWORD *)(i - 4) & 0x3FFFFFFF);
    _InterlockedAnd(&ControlArea->ControlAreaLock, 0xBFFFFFFF);
    _InterlockedDecrement(&ControlArea->ControlAreaLock);
    __writecr8(v9);
    v6 = *PteOffset;
  }
  if( v6 >= v12 )
    return 0i64;
  if( !ControlArea->FilePointer.Value )
    return MiLocatePagefileSubsection((_SUBSECTION *)&ControlArea[1], PteOffset);
  if( (ControlArea->u.LongFlags & 0x20) != 0 )
  {
    v4 = (_SUBSECTION *)&ControlArea[1];
    for( j = HIDWORD(ControlArea[1].NumberOfMappedViews); v6 >= j; j = v4->PtesInSubsection )
    {
      v6 -= j;
      *PteOffset = v6;
      v4 = v4->NextSubsection;
    }
  }
  else
  {
    memset(v27, 0i64, sizeof(v27));
    if( SectionByteOffset >= 0x3FFFFFFFFFF000i64 )
      goto LABEL_20;
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    _m_prefetchw((const void *)&ControlArea->ControlAreaLock);
    v14 = ControlArea->ControlAreaLock & 0x7FFFFFFF;
    if( v14 != _InterlockedCompareExchange(&ControlArea->ControlAreaLock, v14 + 1, v14) )
      ExpWaitForSpinLockSharedAndAcquire((INT64 *)&ControlArea->ControlAreaLock, CurrentIrql);
    NumberOfPfnReferences = ControlArea[2].NumberOfPfnReferences;
    v16 = SectionByteOffset >> 12;
    v17 = *(unsigned int *)(NumberOfPfnReferences + 36) | ((unsigned __int64)(*(_WORD *)(NumberOfPfnReferences + 32) & 0xFFC0) << 26);
    v18 = v17 + *(unsigned int *)(NumberOfPfnReferences + 40);
    if( *(_WORD *)(NumberOfPfnReferences + 34) < 0x10u )
      --v18;
    v19 = HIDWORD(v16);
    if( v16 >= v17 )
    {
      v19 = HIDWORD(v16);
      if( v16 <= v18 )
      {
        if( CurrentIrql != 17 )
        {
          _InterlockedAnd(&ControlArea->ControlAreaLock, 0xBFFFFFFF);
          _InterlockedDecrement(&ControlArea->ControlAreaLock);
          __writecr8(CurrentIrql);
        }
        v4 = (_SUBSECTION *)NumberOfPfnReferences;
        goto LABEL_20;
      }
    }
    v21 = *(_QWORD **)&ControlArea[2].gap8[8];
    v22 = v27[8] & 0x3F | ((_WORD)v19 << 6);
    v27[9] = v16;
    LOWORD(v27[8]) = v22;
    if( v21 )
    {
      v26 = ((unsigned __int64)v22 << 26) ^ (unsigned int)v16 ^ (v22 << 26);
      do
      {
        v24 = *((unsigned int *)v21 - 5) | ((unsigned __int64)(*(_WORD *)(v21 - 3) & 0xFFC0) << 26);
        v25 = v24 + *((unsigned int *)v21 - 4);
        if( *((_WORD *)v21 - 11) < 0x10u )
          --v25;
        if( v26 > v25 )
        {
          v21 = (_QWORD *)v21[1];
        }
        else
        {
          if( v26 >= v24 )
          {
            v4 = (_SUBSECTION *)(v21 - 7);
            ControlArea[2].NumberOfPfnReferences = (unsigned __int64)(v21 - 7);
            if( CurrentIrql != 17 )
              goto LABEL_39;
            goto LABEL_20;
          }
          v21 = (_QWORD *)*v21;
        }
      }
      while( v21 );
    }
    if( CurrentIrql != 17 )
    {
LABEL_39:
      ExReleaseSpinLockSharedFromDpcLevel(&ControlArea->ControlAreaLock);
      __writecr8(CurrentIrql);
    }
LABEL_20:
    *PteOffset -= v4->StartingSector | ((unsigned __int64)(v4->u.SubsectionFlags._bf_0 & 0xFFC0) << 26);
  }
  return v4;
}

Referenced by: