MiPreventControlAreaDeletion

NTSTATUS __stdcall MiPreventControlAreaDeletion(INT64 a1, INT64 a2, INT64 *a3, INT64 **a4){
  int v6; 
  __int64 v7; 
  __int64 v8; 
  _CONTROL_AREA *v9; 
  INT64 *v10; 
  union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v11; 
  _MI_CONTROL_AREA_WAIT_BLOCK *v12; 

  *a4 = 0i64;
  *a3 = 0i64;
  v6 = a2;
  v7 = *(_QWORD *)(a1 + 16);
  if( *(&stru_140C4DB30 + 42) && (v7 & 0x10) == 0 )
    v7 &= ~*(&stru_140C4DB30 + 42);
  v8 = v7 >> 16;
  if( (*(_BYTE *)(v8 + 34) & 2) == 0 )
  {
    v9 = *(_CONTROL_AREA **)v8;
    v10 = (INT64 *)(*(_QWORD *)v8 + 72i64);
    ExAcquireSpinLockExclusiveAtDpcLevel(v10);
    v11.LongFlags = (unsigned int)v9->u;
    if( !(v11.LongFlags & 1 | ((v11.LongFlags & 2) != 0)) )
    {
      if( (v11.LongFlags & 0x20) != 0 )
        goto LABEL_7;
      if( (*(_BYTE *)(v8 + 34) & 1) == 0 && (v6 != 1 || !*(_DWORD *)(v8 + 108)) )
      {
        MiReferenceSubsection((_SUBSECTION *)v8, 0i64);
        *a3 = v8;
LABEL_7:
        v12 = MiBuildWakeList(v9, 4ui64);
        ++v9->ModifiedWriteCount;
        *a4 = (INT64 *)v12;
        MiRemoveUnusedSegment(v9);
        if( v6 == 1 )
          v9->u.LongFlags |= 4u;
        goto LABEL_9;
      }
    }
    LODWORD(v9) = 0;
LABEL_9:
    ExReleaseSpinLockExclusiveFromDpcLevel(v10);
    return(int)v9;
  }
  return 0;
}

Referenced by: