MiReferenceControlArea

NTSTATUS __stdcall MiReferenceControlArea(
        UINT64 AllocationAttributes,
        _FILE_OBJECT *File,
        _CONTROL_AREA *NewControlArea,
        UINT64 CacheManager,
        _CONTROL_AREA **OutControlArea){
  bool v5; 
  __int64 v8; 
  INT64 *v9; 
  unsigned __int8 v10; 
  INT64 v11; 
  unsigned __int64 v12; 
  int v13; 
  _MI_CONTROL_AREA_WAIT_BLOCK *v14; 
  _BYTE *v16; 
  VOID *v17; 
  VOID *v18; 
  CHAR v19; 
  __int128 v20; 
  __int128 v21; 
  __int64 v22; 
  _FILE_OBJECT *FileObject; 

  v5 = (*(_DWORD *)(AllocationAttributes + 16) & 0x1000000) == 0;
  v22 = 0i64;
  v8 = *(_QWORD *)(AllocationAttributes + 56);
  v20 = 0i64;
  FileObject = (_FILE_OBJECT *)v8;
  v21 = 0i64;
  v9 = *(INT64 **)(v8 + 40);
  if( !v5 )
    v9 += 2;
  while( 1 )
  {
    v10 = ExAcquireSpinLockExclusive(&SpinLock);
    v11 = *v9;
    v12 = v10;
    if( !*v9 )
    {
      *v9 = (INT64)File;
      v16 = KeAbPreAcquire(v9, 0i64, 0i64);
      if( v16 )
        v16[26] |= 1u;
      ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
      __writecr8(v12);
      NewControlArea->Segment = (_SEGMENT *)File;
      return 0;
    }
    if( (unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel((INT64 *)(v11 + 72)) )
      break;
    ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
    __writecr8(v12);
  }
  ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
  v13 = MiValidateControlAreaPartition(AllocationAttributes, v11);
  if( v13 < 0 )
  {
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v11 + 72));
LABEL_25:
    __writecr8(v12);
    if( (*(_DWORD *)AllocationAttributes & 1) == 0 )
    {
      KeGetCurrentThread()[1].TrapFrame = *(_KTRAP_FRAME **)(AllocationAttributes + 184);
      FsRtlReleaseFile(FileObject);
      *(_DWORD *)AllocationAttributes &= ~2u;
    }
    return v13;
  }
  else
  {
    if( !(*(_DWORD *)(v11 + 56) & 1 | ((*(_DWORD *)(v11 + 56) & 2) != 0)) )
    {
      if( (*(_DWORD *)(AllocationAttributes + 16) & 0x1000000) != 0
        && (*(_DWORD *)(AllocationAttributes + 20) & 0x100000) != 0
        && !MiControlAreaRequiresCharge(v11) )
      {
        ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v11 + 72));
        v13 = -1073740277;
        goto LABEL_25;
      }
      v14 = MiReferenceActiveControlArea((_DWORD *)AllocationAttributes, (_CONTROL_AREA *)v11);
      ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v11 + 72));
      __writecr8(v12);
      MiReleaseControlAreaWaiters(v14);
      NewControlArea->Segment = (_SEGMENT *)v11;
      return 0;
    }
    v17 = KeAbPreAcquire(v9, 0i64, 0i64);
    v18 = v17;
    if( v17 )
      KeAbPreWait(v17);
    DWORD1(v21) = 0;
    v22 = (__int64)&v21 + 8;
    LOWORD(v21) = 263;
    *((_QWORD *)&v21 + 1) = (char *)&v21 + 8;
    BYTE2(v21) = 6;
    DWORD2(v20) = 1;
    *(_QWORD *)&v20 = *(_QWORD *)(v11 + 80);
    *(_QWORD *)(v11 + 80) = &v20;
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v11 + 72));
    __writecr8(v12);
    if( (*(_DWORD *)AllocationAttributes & 1) == 0 )
    {
      KeGetCurrentThread()[1].TrapFrame = *(_KTRAP_FRAME **)(AllocationAttributes + 184);
      FsRtlReleaseFile(FileObject);
      *(_DWORD *)AllocationAttributes &= ~2u;
    }
    KeWaitForGate((_KGATE *)&v21, WrVirtualMemory, v19);
    if( v18 )
    {
      KeAbPreAcquire(v9, v18, 0i64);
      KeAbPostReleaseEx(v9, v18);
    }
    NewControlArea->Segment = 0i64;
    return -1073741267;
  }
}

Referenced by: