MiUnlinkUnusedControlArea
_QWORD *__fastcall MiUnlinkUnusedControlArea(INT64 a1){
__int64 v2;
__int64 v3;
__int64 v4;
_QWORD *result;
_QWORD *v6;
_QWORD **v7;
v2 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * (*(_WORD *)(a1 + 60) & 0x3FF));
LODWORD(v3) = MiComputePagedPoolSegmentBytes(a1);
v4 = v3;
if( (*(_DWORD *)(a1 + 56) & 0x40000) != 0 && (*(_DWORD *)(v2 + 1348))-- == 1 )
{
KeCancelTimer(v2 + 1616);
*(_BYTE *)(v2 + 1680) = 0;
}
result = (_QWORD *)(a1 + 8);
v6 = *(_QWORD **)(a1 + 8);
if( v6[1] != a1 + 8 || (v7 = *(_QWORD ***)(a1 + 16), *v7 != result) )
__fastfail(3u);
*v7 = v6;
v6[1] = v7;
*(_DWORD *)(a1 + 56) &= ~0x8000000u;
*(_QWORD *)(a1 + 16) = a1 + 8;
*result = result;
*(_QWORD *)(v2 + 1696) -= v4;
_InterlockedExchangeAdd64(&qword_140C4C6D8, -v4);
return result;
}Referenced by:
MiDeleteCachedSegment
MiMakeUnusedSegmentDeleteOnClose
MiProcessDeleteOnClose
MiRemoveUnusedSegment