ViMapDoubleBuffer

UINT64 __stdcall ViMapDoubleBuffer(
        _MAP_REGISTER_FILE *MapRegisterFile,
        _MDL *Mdl,
        VOID *CurrentVa,
        UINT64 Length,
        UINT8 WriteToDevice){
  unsigned int v5; 
  ULONG_PTR v9; 
  ULONG_PTR v10; 
  ULONG_PTR v11; 
  unsigned __int64 v13; 
  char *MappedSystemVa; 
  signed __int64 v15; 
  unsigned __int64 v16; 
  char *v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  char *v20; 
  _MDL *v21; 
  unsigned int v22; 
  _MDL *Next; 
  UINT64 v24; 
  char *v25; 
  UINT64 *v26; 
  unsigned int ByteCount; 
  unsigned __int64 v28; 
  char *v29; 
  _MDL *v30; 
  UINT64 Param4; 
  ULONG_PTR Param4a; 
  UINT64 Param4b; 
  UINT64 *Action; 
  UINT64 *Actiona; 
  UINT64 a7; 
  char *Src; 
  char *v38; 
  char *v39; 
  unsigned __int64 v40; 
  UINT64 MapRegisterNumber; 

  v5 = Length;
  LODWORD(MapRegisterNumber) = 0;
  if( !(_DWORD)Length )
  {
    ViHalPreprocessOptions(
      (UINT64 *)((char *)&qword_140C12D00 + 4),
      (PSTR)"Driver is attempting to map a 0-length transfer.",
      0x21ui64,
      (UINT64)MapRegisterFile,
      0i64,
      0i64,
      a7);
    Actiona = (UINT64 *)((char *)&qword_140C12D00 + 4);
    v9 = 0;
    Param4a = 0;
    v10 = (unsigned int)MapRegisterFile;
    v11 = 33;
LABEL_3:
    VfReportIssueWithOptions(0xE6ui64, v11, v10, v9, Param4a, Actiona);
    return 0i64;
  }
  if( !*((_BYTE *)MapRegisterFile + 25) && (unsigned int)Length >= 4096 - ((unsigned __int16)CurrentVa & 0xFFFu) )
    v5 = 4096 - ((unsigned __int16)CurrentVa & 0xFFF);
  if( CurrentVa < (char *)Mdl->StartVa + Mdl->ByteOffset )
  {
    ViHalPreprocessOptions(
      &qword_140C12D00,
      (PSTR)"Virtual address %p is before the first MDL %p.",
      0x1000001Fui64,
      1ui64,
      (UINT64)CurrentVa,
      (UINT64)Mdl,
      a7);
    Actiona = &qword_140C12D00;
    v9 = (unsigned int)CurrentVa;
    Param4a = (unsigned int)Mdl;
    v10 = 1;
LABEL_10:
    v11 = 31;
    goto LABEL_3;
  }
  if( (unsigned int)CurrentVa - Mdl->ByteOffset - LODWORD(Mdl->StartVa) >= Mdl->ByteCount )
  {
    ViHalPreprocessOptions(
      (UINT64 *)((char *)&qword_140C12D08 + 4),
      (PSTR)"Virtual address %p is after the first MDL %p.",
      0x1000001Fui64,
      2ui64,
      (UINT64)CurrentVa,
      (UINT64)Mdl,
      a7);
    VfReportIssueWithOptions(
      0xE6ui64,
      0x1Fu,
      2u,
      (ULONG_PTR)CurrentVa,
      (ULONG_PTR)Mdl,
      (UINT64 *)((char *)&qword_140C12D08 + 4));
    return 0i64;
  }
  v13 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)MapRegisterFile + 10);
  if( (Mdl->MdlFlags & 5) != 0 )
  {
    MappedSystemVa = (char *)Mdl->MappedSystemVa;
  }
  else
  {
    LODWORD(Action) = 1073741840;
    LODWORD(Param4) = 0;
    MappedSystemVa = (char *)MmMapLockedPagesSpecifyCache(Mdl, 0, MmCached, 0i64, Param4, (UINT64)Action);
  }
  KxReleaseSpinLock((UINT64 *)MapRegisterFile + 10);
  __writecr8(v13);
  if( !MappedSystemVa )
    return 0i64;
  v15 = (char *)CurrentVa - Mdl->ByteOffset - (char *)Mdl->StartVa;
  v16 = Mdl->ByteCount - v15;
  v17 = &MappedSystemVa[v15];
  LODWORD(a7) = 1;
  v40 = v16;
  Src = v17;
  if( !(unsigned int)ViAllocateMapRegistersFromFile(MapRegisterFile, v17, v5, WriteToDevice, &MapRegisterNumber) )
    return 0i64;
  v18 = (unsigned int)((_DWORD)MapRegisterNumber << 12) + (unsigned __int64)((unsigned __int16)v17 & 0xFFF);
  v19 = *((_QWORD *)MapRegisterFile + 9);
  v20 = (char *)(v18 + *((_QWORD *)MapRegisterFile + 8));
  v39 = v20;
  if( !v19 )
    return 0i64;
  v21 = Mdl;
  v38 = (char *)(v18 + v19);
  v22 = v5;
  if( v5 )
  {
    while( 1 )
    {
      if( !v21 )
        return 0i64;
      Next = v21->Next;
      if( (_DWORD)a7 )
      {
        LODWORD(a7) = 0;
        if( !Next && v22 > v16 )
        {
          v24 = v5;
          if( (((v5 - 1) ^ (v16 + v5 - (unsigned __int64)v22)) & 0xFFFFFFFFFFFFF000ui64) != 0 )
          {
            v25 = "Extra transfer length crosses a page boundary: Mdl %p, Length %x.";
            v26 = &qword_140C12D08;
LABEL_26:
            ViHalPreprocessOptions(v26, v25, 0x1000001Fui64, 3ui64, (UINT64)Mdl, v24, a7);
            Actiona = v26;
            v9 = (unsigned int)Mdl;
            Param4a = v24;
            v10 = 3;
            goto LABEL_10;
          }
LABEL_30:
          LODWORD(v16) = v22;
          goto LABEL_34;
        }
      }
      else
      {
        if( !Next )
        {
          ByteCount = v21->ByteCount;
          if( v22 > ByteCount )
          {
            if( (((v5 - 1) ^ (v5 + ByteCount - v22)) & 0xFFFFF000) != 0 )
            {
              v24 = v5;
              v25 = "Extra transfer length crosses a page boundary: Mdl %p, Length %x";
              v26 = (UINT64 *)&unk_140C12CF4;
              goto LABEL_26;
            }
            goto LABEL_30;
          }
        }
        LODWORD(v16) = v21->ByteCount;
      }
      if( v22 < (unsigned int)v16 )
        LODWORD(v16) = v22;
LABEL_34:
      memmove(v20, Src, v16);
      v39 += (unsigned int)v16;
      memmove(v38, Src, v16);
      v38 += (unsigned int)v16;
      v21 = v21->Next;
      if( v21 )
      {
        v28 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)MapRegisterFile + 10);
        if( (v21->MdlFlags & 5) != 0 )
        {
          v29 = (char *)v21->MappedSystemVa;
        }
        else
        {
          LODWORD(Action) = 1073741840;
          LODWORD(Param4b) = 0;
          v29 = (char *)MmMapLockedPagesSpecifyCache(v21, 0, MmCached, 0i64, Param4b, (UINT64)Action);
        }
        Src = v29;
        KxReleaseSpinLock((UINT64 *)MapRegisterFile + 10);
        __writecr8(v28);
        if( !Src )
          return 0i64;
      }
      v22 -= v16;
      if( !v22 )
        break;
      v16 = v40;
      v20 = v39;
    }
  }
  v30 = (_MDL *)*((_QWORD *)MapRegisterFile + 7);
  if( v30 )
    KeFlushIoBuffers(v30, WriteToDevice == 0, 1u);
  return v5;
}

Referenced by: