MiPreventControlAreaDeletion

INT64 __fastcall MiPreventControlAreaDeletion(INT64 a1, INT64 a2, INT64 *a3, INT64 **a4){
  int v6; 
  __int64 v7; 
  __int64 v8; 
  INT64 v9; 
  INT64 *v10; 
  int v11; 
  INT64 *v12; 
  *a4 = 0i64;
  *a3 = 0i64;
  v6 = a2;
  v7 = *(_QWORD *)(a1 + 16);
  if( qword_140C4DC80 && (v7 & 0x10) == 0 )
    v7 &= ~qword_140C4DC80;
  v8 = v7 >> 16;
  if( (*(_BYTE *)(v8 + 34) & 2) == 0 )
  {
    v9 = *(_QWORD *)v8;
    v10 = (INT64 *)(*(_QWORD *)v8 + 72i64);
    ExAcquireSpinLockExclusiveAtDpcLevel(v10);
    v11 = *(_DWORD *)(v9 + 56);
    if( !(v11 & 1 | ((v11 & 2) != 0)) )
    {
      if( (v11 & 0x20) != 0 )
        goto LABEL_7;
      if( (*(_BYTE *)(v8 + 34) & 1) == 0 && (v6 != 1 || !*(_DWORD *)(v8 + 108)) )
      {
        MiReferenceSubsection((_SUBSECTION *)v8, 0i64);
        *a3 = v8;
LABEL_7:
        MiBuildWakeList((_CONTROL_AREA *)v9, 4ui64);
        ++*(_DWORD *)(v9 + 76);
        *a4 = v12;
        MiRemoveUnusedSegment((_CONTROL_AREA *)v9);
        if( v6 == 1 )
          *(_DWORD *)(v9 + 56) |= 4u;
        goto LABEL_9;
      }
    }
    v9 = 0i64;
LABEL_9:
    ExReleaseSpinLockExclusiveFromDpcLevel(v10);
    return v9;
  }
  return 0i64;
}

Referenced by: