MmBuildMdlForNonPagedPool

VOID *__stdcall MmBuildMdlForNonPagedPool(PMDL MemoryDescriptorList){
  unsigned __int64 StartVa; 
  PMDL v2; 
  UINT64 v3; 
  void *v4; 
  unsigned __int64 v6; 
  VOID *result; 
  int v8; 
  unsigned __int64 v9; 
  NTSTATUS v10; 
  unsigned __int64 v11; 
  union {$8D9ED47C9F2F2CD645B633E301950288 __s0;unsigned __int64 EntireField;} *p_u4; 
  _MMPTE *Pml4eBase; 
  __int16 MdlFlags; 
  _MMPTE *PteBase; 
  int v16; 
  __int64 v17; 
  unsigned __int64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  __int64 v22; 
  _QWORD *v23; 
  UINT64 v24; 
  UINT64 BugCheckParameter4; 
  UINT64 v26; 
  int v27; 
  __int64 v28; 
  INT64 *v29; 
  INT64 v30; 
  unsigned __int64 v31; 
  unsigned __int64 v32; 
  unsigned __int64 v33; 
  __int64 v34; 
  __int16 v35; 
  __int64 v36; 
  __int64 v37[4]; 
  __int64 v38[14]; 
  NTSTATUS SystemRegionType; 
  INT64 v40; 
  UINT64 v41; 
  unsigned __int64 v42; 

  StartVa = (unsigned __int64)MemoryDescriptorList->StartVa;
  v2 = MemoryDescriptorList + 1;
  v3 = 0i64;
  v4 = (void *)(StartVa + MemoryDescriptorList->ByteOffset);
  MemoryDescriptorList->Process = 0i64;
  MemoryDescriptorList->MappedSystemVa = v4;
  v41 = 0i64;
  v6 = -1i64;
  result = MmGetPteBase();
  v8 = 0;
  v9 = (unsigned __int64)result + ((StartVa >> 9) & 0x7FFFFFFFF8i64);
  v10 = 0;
  SystemRegionType = 0;
  v11 = v9 + 8 * ((((unsigned __int16)v4 & 0xFFF) + (unsigned __int64)MemoryDescriptorList->ByteCount + 4095) >> 12);
  v42 = v11;
  if( v9 < v11 )
  {
    p_u4 = &MmGetPfnDb()->u4;
    do
    {
      Pml4eBase = MmGetPml4eBase();
      result = (VOID *)0xFFFFFFFFFi64;
      if( v8 )
      {
        if( v8 < 2 )
          goto LABEL_5;
LABEL_19:
        if( (v3 & 1) == 0 )
          KeBugCheckEx(0x1Au, (PVOID)0x1240, MemoryDescriptorList, (PVOID)v9, (PVOID)v3);
        if( v8 == 3 )
          MiSetNonPagedPoolNoSteal((_MMPTE *)v9, (UINT64)Pml4eBase);
        LODWORD(BugCheckParameter4) = MI_READ_PTE_LOCK_FREE(v9);
        v41 = BugCheckParameter4;
        v26 = BugCheckParameter4;
        v3 = BugCheckParameter4;
        if( (BugCheckParameter4 & 1) == 0 )
          KeBugCheckEx(0x1Au, (PVOID)0x1241, MemoryDescriptorList, (PVOID)v9, (PVOID)BugCheckParameter4);
        MiPteInShadowRange((UINT64)&v41);
        result = (VOID *)0xFFFFFFFFFi64;
        v6 = (v26 >> 12) & 0xFFFFFFFFFi64;
        if( v10 == 12 )
        {
          MiQueuePinDriverAddressLog((__int64)((v9 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16, v3, 1ui64);
          result = (VOID *)0xFFFFFFFFFi64;
        }
      }
      else
      {
        PteBase = MmGetPteBase();
        v16 = 4;
        v17 = 4i64;
        v18 = (__int64)((v9 << 25) - ((_QWORD)PteBase << 25)) >> 16;
        v19 = (unsigned __int64)PteBase + ((v18 >> 9) & 0x7FFFFFFFF8i64);
        v37[1] = v19;
        v20 = (unsigned __int64)PteBase + ((v19 >> 9) & 0x7FFFFFFFF8i64);
        v37[2] = v20;
        v21 = (unsigned __int64)PteBase + ((v20 >> 9) & 0x7FFFFFFFF8i64);
        v37[3] = v21;
        v22 = (__int64)PteBase + ((v21 >> 9) & 0x7FFFFFFFF8i64);
        v38[0] = v22;
        while( 1 )
        {
          v23 = (_QWORD *)v37[v17--];
          --v16;
          if( (*v23 & 1) == 0 )
            goto LABEL_17;
          if( (*v23 & 0x80u) != 0i64 )
            break;
          if( v17 == 1 )
            goto LABEL_17;
        }
        if( !v16 )
        {
LABEL_17:
          LODWORD(v24) = MI_READ_PTE_LOCK_FREE(v9);
          v3 = v24;
          SystemRegionType = MiGetSystemRegionType(v18);
          v10 = SystemRegionType;
          if( SystemRegionType == 5 )
            v8 = 3;
          else
            v8 = 2;
          goto LABEL_19;
        }
        v38[4] = v22;
        v27 = 4;
        v38[2] = v20;
        v28 = 4i64;
        v38[1] = v19;
        v38[3] = v21;
        do
        {
          v29 = (INT64 *)v38[v28--];
          --v27;
          v30 = *v29;
          v40 = *v29;
        }
        while( v28 && (v30 & 0x80u) == 0i64 );
        LODWORD(v31) = MI_READ_PTE_LOCK_FREE((INT64)&v40);
        v11 = v42;
        v32 = v31 >> 12;
        result = (VOID *)0xFFFFFFFFFi64;
        v6 = v32 & 0xFFFFFFFFFi64;
        if( v28 )
        {
          v33 = v18 >> 12;
          v34 = 1i64;
          if( v27 )
          {
            do
            {
              v35 = v33;
              v33 >>= 9;
              v36 = v34 * (v35 & 0x1FF);
              v34 <<= 9;
              v6 += v36;
              --v27;
            }
            while( v27 );
            result = (VOID *)0xFFFFFFFFFi64;
          }
        }
        v3 = v41;
        v8 = 1;
        v10 = SystemRegionType;
      }
      p_u4 = &MmGetPfnDb()->u4;
LABEL_5:
      v2->Next = (_MDL *)v6;
      MdlFlags = MemoryDescriptorList->MdlFlags;
      if( (MdlFlags & 0x800) == 0 )
      {
        if( v6 > 0xFFFFFFFFFi64 || (result = p_u4, (((unsigned __int64)p_u4[6 * v6]._bf_0 >> 50) & 1) == 0) )
          MemoryDescriptorList->MdlFlags = MdlFlags | 0x800;
      }
      v2 = (PMDL)((char *)v2 + 8);
      v9 += 8i64;
      if( (v9 & 0xFFF) != 0 )
      {
        if( v8 == 1 )
          ++v6;
      }
      else
      {
        v8 = 0;
      }
    }
    while( v9 < v11 );
  }
  MemoryDescriptorList->MdlFlags |= 4u;
  return result;
}

Referenced by: