MiPfAllocateMdls

NTSTATUS __stdcall MiPfAllocateMdls(_MI_READ_LIST *MiReadList, UINT64 SessionId, VOID *SystemCacheAddress){
  _MI_READ_LIST v4; 
  _FILE_OBJECT *v5; 
  _CONTROL_AREA *v6; 
  _MI_READ_LIST *v7; 
  unsigned __int64 v8; 
  _MI_READ_LIST *v9; 
  _MI_READ_LIST *v10; 
  _SUBSECTION *v11; 
  _MI_READ_LIST *v12; 
  NTSTATUS v13; 
  __int64 v14; 
  __int64 v15; 
  unsigned __int64 v16; 
  _MMPTE *v18; 
  unsigned __int64 v19; 
  _MMINPAGE_SUPPORT *v20; 
  _MMINPAGE_SUPPORT *v21; 
  _MDL *v22; 
  UINT64 v23; 
  _SUBSECTION *v24; 
  __int64 *v25; 
  unsigned int v26; 
  unsigned __int64 SubsectionBase; 
  _LARGE_INTEGER v28; 
  ULONG LowPart; 
  _MDL *v30; 
  _MI_READ_LIST **v31; 
  _MI_PER_SESSION_PROTOS *SubsectionDriverProtos; 
  unsigned __int64 v33; 
  NTSTATUS v34; 
  unsigned int v35; 
  __int64 v36; 
  _RTL_BALANCED_NODE *SharedProtos; 
  _RTL_BALANCED_NODE *v38; 
  _MMPTE *v39; 
  _SUBSECTION *Subsection; 
  _MI_READ_LIST *v41; 
  _MI_READ_LIST *v42; 
  _MDL *p_Mdl; 
  unsigned int FinalPriority; 
  unsigned int FinalPriority_4; 
  __int64 *v46; 
  _MMPTE *v47; 
  _CONTROL_AREA *ControlArea; 
  _MMINPAGE_SUPPORT *v49; 
  _MI_READ_LIST *v50; 
  unsigned __int64 v51; 
  unsigned int SessionIda; 
  unsigned int v55; 

  SessionIda = SessionId;
  FinalPriority = MiReadList[20];
  v4 = MiReadList[21];
  v5 = 0i64;
  v6 = (_CONTROL_AREA *)*((_QWORD *)MiReadList + 1);
  v7 = 0i64;
  v55 = 0;
  v8 = 0i64;
  v46 = 0i64;
  v47 = 0i64;
  v9 = (_MI_READ_LIST *)*((_QWORD *)MiReadList + 12);
  v10 = &MiReadList[2 * MiReadList[23] + 34];
  FinalPriority_4 = v4;
  ControlArea = v6;
  v50 = v10;
  v41 = v9;
  if( v9 >= v10 )
    return 0;
  v11 = (_SUBSECTION *)&v6[1];
  v12 = v9 + 2;
  v42 = v9 + 2;
  if( *((_QWORD *)MiReadList + 2) )
    v11 = (_SUBSECTION *)*((_QWORD *)MiReadList + 2);
  v13 = 0;
  Subsection = v11;
  while( 1 )
  {
    v14 = *(_QWORD *)v9;
    v15 = (*(_QWORD *)v9 >> 2) & 0x3FFFFFFFi64;
    if( (*(_QWORD *)v9 & 2) != 0 )
      break;
LABEL_6:
    if( (v14 & 1) != 0 )
    {
      if( v15 )
      {
        v33 = v14 & 0xFFFFFFFFFFFFFFFCui64;
        if( v5 )
        {
          if( (__int64)(v33 - v8) >> 3 > *(&stru_140C4DB30 + 947) )
            goto LABEL_17;
        }
        else
        {
          v7 = v9;
          v47 = (_MMPTE *)v9;
        }
        v5 = (_FILE_OBJECT *)v9;
        v8 = v33;
      }
      if( v5 )
        goto LABEL_18;
    }
    else
    {
      v16 = v14 & 0xFFFFFFFFFFFFFFFCui64;
      if( v5 )
      {
        if( (__int64)(v16 - v8) >> 3 > *(&stru_140C4DB30 + 947) )
          goto LABEL_17;
      }
      else
      {
        v7 = v9;
        v47 = (_MMPTE *)v9;
      }
      v5 = (_FILE_OBJECT *)v9;
      v8 = v16;
      if( v12 == v10 )
        goto LABEL_18;
    }
LABEL_10:
    v9 += 2;
    v12 += 2;
    v41 = v9;
    v42 = v12;
    if( v9 >= v10 )
      return v13;
  }
  if( !v5 )
  {
    if( !v15 )
      goto LABEL_10;
    goto LABEL_6;
  }
  if( !v15 )
    goto LABEL_18;
LABEL_17:
  v41 = v9 - 2;
  v42 = v12 - 2;
LABEL_18:
  v51 = *(_QWORD *)&v5->Type & 0xFFFFFFFFFFFFFFFCui64;
  v18 = (_MMPTE *)(*(_QWORD *)v7 & 0xFFFFFFFFFFFFFFFCui64);
  v19 = ((__int64)(v51 - (_QWORD)v18) >> 3) + 1;
  MiGetInPageSupportBlock();
  v49 = v20;
  v21 = v20;
  if( !v20 )
    return -1073741670;
  v20->Pfn = 0i64;
  MiSetInPagePriority(v20, FinalPriority_4, FinalPriority);
  v23 = v19 << 12;
  if( v19 <= 0x10 )
  {
    p_Mdl = &v21->Mdl;
    v21->Mdl.Size = 8 * (((__int64)(v51 - (_QWORD)v18) >> 3) + 7);
    v21->Mdl.Next = v22;
    v21->Mdl.MdlFlags = (__int16)v22;
    v21->Mdl.StartVa = v22;
    v21->Mdl.ByteOffset = (unsigned int)v22;
    v21->Mdl.ByteCount = v23;
    goto LABEL_21;
  }
  p_Mdl = MmCreateMdl(0i64, 0i64, v23);
  if( p_Mdl )
  {
LABEL_21:
    v24 = Subsection;
    v25 = v46;
    v26 = v55;
    while( 1 )
    {
      SubsectionBase = (unsigned __int64)v24->SubsectionBase;
      if( (unsigned __int64)v18 >= SubsectionBase
        && (unsigned __int64)v18 < SubsectionBase + 8i64 * v24->PtesInSubsection )
      {
        break;
      }
      if( (v24->u.SubsectionFlags._bf_2 & 2) != 0 && (ControlArea->u.LongFlags & 0x4000000) != 0 )
      {
        if( v24->GlobalPerSessionHead.Root )
        {
          SharedProtos = MiGetSharedProtos(ControlArea, SessionIda, v24);
          if( SharedProtos )
          {
            v38 = SharedProtos[3].Children[0];
            if( v18 >= (_MMPTE *)v38 && v18 < (_MMPTE *)&v38->Children[v24->PtesInSubsection] )
              break;
          }
        }
      }
      if( (ControlArea->u.LongFlags & 0x20) != 0 )
      {
        SubsectionDriverProtos = MiGetSubsectionDriverProtos(v24);
        if( SubsectionDriverProtos )
        {
          v39 = SubsectionDriverProtos->SubsectionBase;
          if( v18 >= v39 && v18 < &v39[v24->PtesInSubsection] )
            break;
        }
      }
      if( *((_QWORD *)MiReadList + 2) )
      {
        if( v25 )
        {
          if( v26 >= *((_DWORD *)v25 + 4) )
          {
            v25 = (__int64 *)*v25;
            v26 = 1;
            v24 = (_SUBSECTION *)v25[3];
          }
          else
          {
            v36 = v26++;
            v24 = (_SUBSECTION *)v25[v36 + 3];
          }
        }
        else
        {
          v25 = (__int64 *)*((_QWORD *)MiReadList + 3);
          v26 = 1;
          v24 = (_SUBSECTION *)v25[3];
        }
      }
      else
      {
        v24 = v24->NextSubsection;
      }
    }
    v55 = v26;
    v46 = v25;
    Subsection = v24;
    v28.anonymous_0.LowPart = MiStartingOffset(v24, v18, SessionIda);
    LowPart = v28.anonymous_0.LowPart;
    v9 = v41;
    v12 = v42;
    v10 = v50;
    v8 = v51;
    v49->ReadOffset = v28;
    if( (v5->Type & 1) != 0 && (ControlArea->u.LongFlags & 0x20) != 0 )
    {
      v34 = MiEndingOffsetWithLock(Subsection);
      v30 = p_Mdl;
      v35 = v34 - LowPart;
      if( v35 <= p_Mdl->ByteCount )
        p_Mdl->ByteCount = (v35 + 511) & 0xFFFFFE00;
    }
    else
    {
      v30 = p_Mdl;
    }
    v7 = (_MI_READ_LIST *)v47;
    v49->BasePte = v47;
    v49->FilePointer = v5;
    v49->ControlArea = ControlArea;
    v49->FaultingAddress = SystemCacheAddress;
    if( SystemCacheAddress )
      v49->u1.e1._bf_0 |= 0x8000u;
    v49->PrefetchMdl = v30;
    v31 = (_MI_READ_LIST **)*((_QWORD *)MiReadList + 16);
    if( *v31 != MiReadList + 30 )
      __fastfail(3u);
    *(_QWORD *)v49->gap0 = MiReadList + 30;
    *(_QWORD *)&v49->gap0[8] = v31;
    *v31 = (_MI_READ_LIST *)v49;
    *((_QWORD *)MiReadList + 16) = v49;
    ++MiReadList[27];
    v13 = 0;
    v5 = 0i64;
    goto LABEL_10;
  }
  MiFreeInPageSupportBlock(v21);
  return -1073741670;
}

Referenced by: