MiGetControlAreaPtes

unsigned __int64 __fastcall MiGetControlAreaPtes(__int64 a1){
  int v1; 
  volatile LONG *v4; 
  unsigned __int64 v5; 
  _SUBSECTION *LastSubsection; 
  unsigned __int64 v7; 
  v1 = *(_DWORD *)(a1 + 56);
  if( (v1 & 0x20) != 0 || !*(_QWORD *)(a1 + 64) || (v1 & 0x400) != 0 )
    return *(unsigned int *)(*(_QWORD *)a1 + 8i64) | ((unsigned __int64)(*(_WORD *)(*(_QWORD *)a1 + 12i64) & 0x3FF) << 32);
  v4 = (volatile LONG *)(a1 + 72);
  v5 = ExAcquireSpinLockShared((PEX_SPIN_LOCK)(a1 + 72));
  LastSubsection = MiFindLastSubsection((_CONTROL_AREA *)a1, 1ui64);
  v7 = (*((unsigned int *)LastSubsection + 9) | ((unsigned __int64)(*((_WORD *)LastSubsection + 16) & 0xFFC0) << 26))
     + *((unsigned int *)LastSubsection + 11)
     - (unsigned __int64)(*((_DWORD *)LastSubsection + 13) & 0x3FFFFFFF);
  ExReleaseSpinLockSharedFromDpcLevel(v4);
  __writecr8(v5);
  return v7;
}

Referenced by: