IopReferenceIoAttributionFromProcess

__int64 __fastcall IopReferenceIoAttributionFromProcess(__int64 a1, char a2, _QWORD *a3){
  KIRQL v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  if( !*(_QWORD *)(a1 + 2392) )
    return 3221226021i64;
  v7 = ExAcquireSpinLockShared(&IopDiskIoAttributionLock);
  v8 = *(_QWORD *)(a1 + 2392);
  v9 = v7;
  if( v8 )
  {
    if( a2 )
    {
      *a3 = *(_QWORD *)(v8 + 24);
    }
    else
    {
      if( _InterlockedIncrement64((volatile signed __int64 *)(v8 + 32)) <= 1 )
        __fastfail(0xEu);
      *a3 = v8;
    }
  }
  ExReleaseSpinLockSharedFromDpcLevel(&IopDiskIoAttributionLock);
  __writecr8(v9);
  return v8 == 0 ? 0xC0000225 : 0;
}

Referenced by: