MiUpControlAreaRefs

VOID __stdcall MiUpControlAreaRefs(_MMVAD_SHORT *Vad){
  int v1; 
  int v2; 
  INT64 v4; 
  NTSTATUS v5; 
  __int64 v6; 
  union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v7; 
  UINT64 v8; 
  _MSUBSECTION *v9; 
  UINT8 v10; 
  unsigned __int64 v11; 
  int v12; 
  _SUBSECTION *v13; 
  _SUBSECTION *p_Core; 
  __int64 v15; 
  __int64 v16; 
  UINT64 v17; 
  UINT64 v18; 
  _ETHREAD *v19; 
  unsigned int SessionId; 
  unsigned __int8 v21; 
  int v22; 
  bool v23; 
  __int64 v24; 
  _KLOCK_ENTRY *v25; 
  __int64 v26; 
  int v27; 
  int v28; 
  _BOOL4 a2; 
  _SUBSECTION *Subsection; 
  _EX_PUSH_LOCK *v31; 
  _ETHREAD *CurrentThread; 
  NTSTATUS active; 
  int v34; 
  UINT64 a3; 

  v34 = v1;
  v2 = v1;
  v28 = 0;
  v4 = *(_QWORD *)Vad[1].ExtraCreateInfo;
  v5 = MiControlAreaRequiresCharge(v4);
  if( v5 )
  {
    v6 = *(_QWORD *)(v4 + 64);
    v7.LongFlags = (unsigned int)Vad->u;
    a2 = v6 != 0;
    if( ((v7.LongFlags & 0xF80) == 512 || (v7.LongFlags & 0xF80) == 768) && v6 && (*(_DWORD *)(v4 + 56) & 0x20) == 0 )
    {
      if( v2 )
        _InterlockedIncrement((volatile signed __int32 *)(v4 + 92));
      else
        _InterlockedAdd((volatile signed __int32 *)(v4 + 92), 0xFFFFFFFF);
      v28 = 1;
    }
    v8 = 0i64;
    active = 0;
    v9 = 0i64;
    v27 = 0;
    Subsection = 0i64;
    if( (*(_DWORD *)(v4 + 56) & 0x400) == 0 )
    {
      MiLockNestedVad(Vad);
      if( !*(_QWORD *)(v4 + 64) || (*(_DWORD *)(v4 + 56) & 0x20) != 0 )
      {
        v9 = (_MSUBSECTION *)(v4 + 128);
        Subsection = (_SUBSECTION *)(v4 + 128);
      }
      else
      {
        MiGetProtoPteAddress();
        v9 = 0i64;
      }
      if( v9 )
        v27 = 1;
      else
        MiUnlockNestedVad(Vad);
    }
    if( *(_QWORD *)(v4 + 64) )
    {
      CurrentThread = 0i64;
      v31 = 0i64;
    }
    else
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      v31 = *(_EX_PUSH_LOCK **)v4;
      --CurrentThread->Tcb.SpecialApcDisable;
      ExAcquirePushLockExclusiveEx(v31 + 5, 0i64);
      v9 = (_MSUBSECTION *)Subsection;
    }
    v10 = ExAcquireSpinLockExclusive((INT64 *)(v4 + 72));
    ++*(_QWORD *)(v4 + 40);
    ++*(_QWORD *)(v4 + 48);
    v11 = v10;
    if( v9 )
    {
      v12 = *(_DWORD *)(v4 + 56);
      if( (v12 & 0x20) == 0 && *(_QWORD *)(v4 + 64) )
      {
        MiGetProtoPteAddress();
        v13 = 0i64;
        p_Core = &v9->Core;
        while( 1 )
        {
          if( v34 )
          {
            active = MiReferenceActiveSubsection(p_Core, 8ui64, v11);
            if( active < 0 )
            {
              if( v13 )
              {
                LODWORD(v15) = MiDecrementSubsections(&v9->Core, v13, 8ui64);
                v8 += v15;
              }
              goto LABEL_39;
            }
          }
          else
          {
            LODWORD(v16) = MiDecrementSubsections(&v9->Core, &v9->Core, 8ui64);
            v8 += v16;
          }
          v13 = p_Core;
          p_Core = p_Core->NextSubsection;
          if( !p_Core )
            goto LABEL_39;
        }
      }
      if( v2 )
      {
        active = MiReferenceActiveSubsection(&v9->Core, 8ui64, v10);
        goto LABEL_39;
      }
      if( (v12 & 0x20) != 0 )
      {
        if( v5 != 2 )
          goto LABEL_39;
        LODWORD(v17) = MiDecrementSubsectionViewCount(v9);
      }
      else
      {
        LODWORD(v17) = MiDecrementSubsections(&v9->Core, &v9->Core, 8ui64);
      }
      v8 = v17;
    }
LABEL_39:
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v4 + 72));
    __writecr8(v11);
    if( v8 )
      MiReturnCrossPartitionSectionCharges(
        *(_MI_CROSS_PARTITION_CHARGES **)(*(&stru_140C4DB30 + 267) + 8i64 * (*(_WORD *)(v4 + 60) & 0x3FF)),
        a2,
        v8);
    if( !*(_QWORD *)(v4 + 64) )
    {
      v18 = (UINT64)&v31[5];
      if( (_InterlockedExchangeAdd64(&v31[5]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((_EX_PUSH_LOCK *)v18);
      LODWORD(a3) = 0;
      v19 = (_ETHREAD *)KeGetCurrentThread();
      if( MiGetSystemRegionType(v18) == 1 )
        SessionId = MmGetSessionIdEx(v19->Tcb.ApcState.Process);
      else
        SessionId = -1;
      --v19->Tcb.SpecialApcDisable;
      v21 = ++v19->Tcb.AbAllocationRegionCount;
      v22 = ((char)v19->Tcb.AbEntrySummary | (char)v19->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
      while( 1 )
      {
        v23 = !_BitScanReverse((unsigned int *)&v24, v22);
        if( v23 )
          break;
        v25 = &v19->Tcb.LockEntries[v24];
        v22 &= ~(1 << v24);
        if( (v25->AcquiredByte & 1) != 0
          && (v25->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
          && (v25->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v18 & 0x7FFFFFFFFFFFFFFCi64)
          && v25->LockState.SessionId == SessionId )
        {
          v25->AcquiredByte &= ~1u;
          if( v25->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
          {
            if( v25 )
            {
              v25->CrossThreadReleasableAndBusyByte |= 2u;
              if( v25->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
                KiAbEntryRemoveFromTree(v25);
              LODWORD(a3) = v25->BoostBitmap.AllFields & 0x1FFFF;
              v25->BoostBitmap.AllFields &= 0xFFFE0000;
              v25->ThreadLocalFlags &= ~1u;
              v25->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
              v26 = v25 - v19->Tcb.LockEntries;
              if( v21 == 1 )
                v19->Tcb.AbEntrySummary |= 1 << v26;
              else
                _InterlockedOr8((volatile signed __int8 *)&v19->Tcb.AbOrphanedEntrySummary, 1 << v26);
              goto LABEL_60;
            }
            break;
          }
        }
      }
      if( (*(&v19->Tcb.MiscFlags + 1) & 0x10000) == 0 )
        KeBugCheckEx(0x162u, v19, (PVOID)v18, (PVOID)SessionId, 0i64);
LABEL_60:
      --v19->Tcb.AbAllocationRegionCount;
      KiAbThreadRemoveBoosts(&v19->Tcb, (VOID *)v18, &a3);
      v23 = v19->Tcb.SpecialApcDisable++ == -1;
      if( v23 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v19->Tcb.ApcState.ApcListHead[0].Flink != &v19->Tcb.152 )
        KiCheckForKernelApcDelivery();
      KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    }
    if( v27 == 1 )
      MiUnlockNestedVad(Vad);
    if( active < 0 && v28 == 1 )
      _InterlockedDecrement((volatile signed __int32 *)(v4 + 92));
  }
}

Referenced by: