MiReferenceControlAreaFile

_FILE_OBJECT *__stdcall MiReferenceControlAreaFile(_CONTROL_AREA *ControlArea){
  _EX_FAST_REF *v2; 
  signed __int64 v3; 
  signed __int64 v4; 
  _FILE_OBJECT *v5; 
  unsigned int v6; 
  volatile LONG *v8; 
  unsigned __int64 v9; 
  _FILE_OBJECT *v10; 
  INT64 v11; 
  signed __int64 Value; 
  signed __int64 v13; 
  signed __int64 v14; 
  ULONG_PTR BugCheckParameter4; 
  v2 = (_EX_FAST_REF *)((char *)ControlArea + 64);
  _m_prefetchw((char *)ControlArea + 64);
  v3 = *((_QWORD *)ControlArea + 8);
  if( (v3 & 0xF) != 0 )
  {
    do
    {
      v4 = _InterlockedCompareExchange64((volatile signed __int64 *)v2, v3 - 1, v3);
      if( v3 == v4 )
        break;
      v3 = v4;
    }
    while( (v4 & 0xF) != 0 );
  }
  v5 = (_FILE_OBJECT *)(v3 & 0xFFFFFFFFFFFFFFF0ui64);
  v6 = v3 & 0xF;
  if( v6 <= 1 )
  {
    if( !v6 )
      goto LABEL_7;
    ObReferenceObjectExWithTag(v5, 0xFui64);
    _m_prefetchw(v2);
    Value = v2->Value;
    while( (Value & 0xF) == 0 )
    {
      if( v5 != (_FILE_OBJECT *)(Value & 0xFFFFFFFFFFFFFFF0ui64) )
        break;
      v13 = Value;
      Value = _InterlockedCompareExchange64((volatile signed __int64 *)v2, Value + 15, Value);
      if( v13 == Value )
        goto LABEL_4;
    }
    ObpTraceObjectDereferenceIfActive(
      (INT64)&v5[-1].Event.Header.WaitListHead.Blink,
      (_BYTE *)0xF,
      1953261124i64,
      v11,
      BugCheckParameter4);
    v14 = _InterlockedExchangeAdd64(
            (volatile signed __int64 *)&v5[-1].Event.Header.WaitListHead.Blink,
            0xFFFFFFFFFFFFFFF1ui64)
        - 15;
    if( v14 <= 0 )
    {
      if( v5[-1].CompletionContext )
        KeBugCheckEx(
          0x18u,
          ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v5[-1].IrpList.Flink) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v5 - 48) >> 8)],
          (ULONG_PTR)v5,
          6ui64,
          (ULONG_PTR)v5[-1].CompletionContext);
      if( v14 < 0 )
        KeBugCheckEx(0x18u, 0i64, (ULONG_PTR)v5, 5ui64, v14);
      ObpDeferObjectDeletion((INT64)&v5[-1].Event.Header.WaitListHead.Blink);
    }
  }
LABEL_4:
  if( v5 )
    return v5;
LABEL_7:
  v8 = (volatile LONG *)((char *)ControlArea + 72);
  v9 = ExAcquireSpinLockShared((PEX_SPIN_LOCK)ControlArea + 18);
  v10 = (_FILE_OBJECT *)ObFastReferenceObjectLocked(v2);
  ExReleaseSpinLockSharedFromDpcLevel(v8);
  __writecr8(v9);
  return v10;
}

Referenced by: