MiFaultGetFileExtents

INT64 __fastcall MiFaultGetFileExtents(INT64 a1, INT64 a2){
  _QWORD *v2; 
  ULONG_PTR v4; 
  _QWORD *v6; 
  unsigned int SessionId; 
  unsigned int FileExtents; 
  v2 = *(_QWORD **)(a2 + 208);
  v4 = *(_QWORD *)(a2 + 232);
  v6 = (_QWORD *)*v2;
  if( (*((_BYTE *)v2 + 34) & 2) != 0 )
  {
    SessionId = MmGetSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
    v4 = v2[1] + 8 * ((__int64)(v4 - MiGetSharedProtos((__int64)v6, SessionId, (__int64)v2)[9]) >> 3);
  }
  MiRetainSubsection((ULONG_PTR)v2);
  ExAcquireSpinLockExclusiveAtDpcLevel(v6 + 9);
  ++v6[5];
  ++v6[6];
  ExReleaseSpinLockExclusiveFromDpcLevel(v6 + 9);
  MiReleaseFaultSynchronization(a1);
  FileExtents = MiAllocateFileExtents((ULONG_PTR)v2, (__int64)(v4 - v2[1]) >> 3, v4, 1, 2);
  MiFreeInPageSupportBlock((PSLIST_ENTRY)a2);
  MiDereferenceControlArea((__int64)v6);
  MiReleaseFaultCharges(v2);
  return FileExtents;
}

Referenced by: