EtwpBuildMdlForTraceBuffer

NTSTATUS __stdcall EtwpBuildMdlForTraceBuffer(_WMI_BUFFER_HEADER *Buffer, _MDL **OutMdl){
  _MDL **v2; 
  unsigned int v3; 
  _MDL **v4; 
  _MDL **v5; 
  NTSTATUS v7; 
  _MDL *Mdl; 
  _MDL *v9; 
  __int64 v10; 
  _MDL *v11; 
  unsigned __int64 v12; 

  v3 = *(_DWORD *)OutMdl;
  v4 = OutMdl;
  v5 = v2;
  v7 = 0;
  Mdl = IoAllocateMdl(OutMdl, *(unsigned int *)OutMdl, 0, 0, 0i64);
  v9 = Mdl;
  if( !Mdl )
    return -1073741670;
  if( (*((_DWORD *)Buffer + 208) & 0x20000000) != 0 )
  {
    v10 = v3 >> 12;
    v11 = Mdl + 1;
    if( (_DWORD)v10 )
    {
      do
      {
        LODWORD(v12) = MmGetPhysicalAddress((UINT64)v4);
        v4 += 512;
        v11->Next = (_MDL *)(v12 >> 12);
        v11 = (_MDL *)((char *)v11 + 8);
        --v10;
      }
      while( v10 );
    }
  }
  else
  {
    MmBuildMdlForNonPagedPool(Mdl);
  }
  *v5 = v9;
  return v7;
}

Referenced by: