MiFlushControlArea

VOID __fastcall MiFlushControlArea(
        _CONTROL_AREA *ControlArea,
        _BYTE *OldIrql,
        _MI_CONTROL_AREA_WAIT_BLOCK **Gate,
        _FILE_OBJECT **AcquiredFileObject){
  unsigned __int64 v4; 
  _FILE_OBJECT *v6; 
  __int64 v7; 
  BOOL v8; 
  unsigned __int64 v9; 
  signed __int64 v10; 
  int v11; 
  __int64 v12; 
  KIRQL v13; 
  _MI_CONTROL_AREA_WAIT_BLOCK *v14; 
  UINT64 inserted; 
  unsigned int v16; 
  volatile INT64 *v17; 
  INT64 *SpinLock; 
  __int128 v19; 
  _QWORD *v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23[10]; 
  BOOL v24; 
  *((_DWORD *)ControlArea + 14) |= 0x100u;
  v23[1] = (__int64)v23;
  v4 = (unsigned __int8)OldIrql;
  v23[0] = (__int64)v23;
  v20 = (_QWORD *)*((_QWORD *)ControlArea + 10);
  v22 = 393479i64;
  *((_QWORD *)ControlArea + 10) = &v20;
  v19 = 0i64;
  *AcquiredFileObject = 0i64;
  *Gate = 0i64;
  v21 = 4i64;
  v6 = (_FILE_OBJECT *)MiPreventControlAreaDelete((__int64)ControlArea);
  SpinLock = (INT64 *)((char *)ControlArea + 72);
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)ControlArea + 9);
  __writecr8(v4);
  v7 = 0i64;
  v8 = FsRtlAcquireFileForCcFlushEx(v6) >= 0;
  v24 = v8;
  v9 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)ControlArea + 18);
  v10 = _InterlockedDecrement64((volatile signed __int64 *)ControlArea + 14);
  *(_QWORD *)(*(_QWORD *)(qword_140C4E388 + 8i64 * (*((_WORD *)ControlArea + 30) & 0x3FF)) + 1688i64) = 0i64;
  if( !v8 || (*((_DWORD *)ControlArea + 14) & 1) != 0 )
  {
    *((_DWORD *)ControlArea + 14) &= ~0x100u;
    HIDWORD(v21) = 1;
    if( !v10 )
    {
      MiRemoveWakeListEntry((__int64)ControlArea, &v20);
      ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)ControlArea + 9);
      __writecr8(v9);
      if( v8 )
        FsRtlReleaseFileForCcFlush(v6);
      MiDeleteControlArea(ControlArea);
      ObfDereferenceObjectWithTag(v6, 0x746C6644ui64);
      return;
    }
    v11 = 0;
  }
  else
  {
    ++*((_DWORD *)ControlArea + 19);
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)ControlArea + 9);
    __writecr8(v9);
    *((_QWORD *)KeGetCurrentThread() + 152) = 1i64;
    v11 = MiFlushSectionInternal(0i64, 0i64, (__int64 *)ControlArea + 16, 0i64, 0i64, 2u, (__int64)&v19);
    *((_QWORD *)KeGetCurrentThread() + 152) = 0i64;
    if( v11 < 0 )
    {
      LODWORD(v12) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
      v7 = v12;
    }
    v13 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)ControlArea + 18);
    *((_DWORD *)ControlArea + 14) &= ~0x100u;
    LOBYTE(v9) = v13;
    MiDecrementModifiedWriteCount(ControlArea, (_BYTE *)1);
    *Gate = v14;
  }
  inserted = 0i64;
  MiRemoveWakeListEntry((__int64)ControlArea, &v20);
  if( *((_QWORD *)ControlArea + 3) | *((_QWORD *)ControlArea + 5) | *((_DWORD *)ControlArea + 14) & 1i64 )
    goto LABEL_20;
  if( !HIDWORD(v21) || !*((_QWORD *)ControlArea + 4) )
  {
    if( v11 >= 0 || !*((_QWORD *)ControlArea + 4) )
      goto LABEL_17;
    if( v11 != -1073740749 && (unsigned int)MmIsWriteErrorFatal(1ui64, v16, (unsigned int)v11) )
    {
      if( v7 )
      {
        *(_QWORD *)(v7 + 32) = ObFastReferenceObjectLocked((_EX_FAST_REF *)ControlArea + 8);
        *(_BYTE *)(v7 + 48) = 1;
        *(_DWORD *)(v7 + 40) = v11;
        *(_QWORD *)v7 = 0i64;
        *(_QWORD *)(v7 + 16) = MiLdwPopupWorker;
        *(_QWORD *)(v7 + 24) = v7;
        ExQueueWorkItem((WORK_QUEUE_ITEM *)v7, DelayedWorkQueue);
      }
LABEL_17:
      *AcquiredFileObject = v6;
      return;
    }
  }
  inserted = MiInsertUnusedSegment(ControlArea);
  if( !inserted )
LABEL_20:
    v17 = 0i64;
  else
    v17 = *(volatile INT64 **)(qword_140C4E388 + 8i64 * (*((_WORD *)ControlArea + 30) & 0x3FF));
  ExReleaseSpinLockExclusiveFromDpcLevel(SpinLock);
  __writecr8((unsigned __int8)v9);
  if( v24 )
    FsRtlReleaseFileForCcFlush(v6);
  ObfDereferenceObjectWithTag(v6, 0x746C6644ui64);
  if( inserted )
    MiReturnCrossPartitionSectionCharges(v17, 1i64, inserted);
  if( v7 )
    ExFreePoolWithTag((PVOID)v7, 0);
}

Referenced by: