IoAllocateMdl

PMDL __stdcall IoAllocateMdl(
        PVOID VirtualAddress,
        ULONG Length,
        BOOLEAN SecondaryBuffer,
        BOOLEAN ChargeQuota,
        PIRP Irp){
  __int16 v5; 
  __int16 v8; 
  unsigned __int64 v9; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v11; 
  PMDL result; 
  int v13; 
  __int64 v14; 
  __int64 v15; 
  __int64(__fastcall *v16)(__int64, __int64, __int64); 
  __int64 v17; 
  __int64 v18; 
  unsigned int v19; 
  _QWORD **v20; 
  _QWORD *i; 
  v5 = (__int16)VirtualAddress;
  v8 = 0;
  v9 = (((unsigned __int16)VirtualAddress & 0xFFF) + (unsigned __int64)Length + 4095) >> 12;
  if( (unsigned int)v9 > 0x11 )
  {
    v19 = 8 * v9 + 48;
  }
  else
  {
    v8 = 8;
    CurrentPrcb = KeGetCurrentPrcb();
    v11 = *((_QWORD *)CurrentPrcb + 262);
    ++*(_DWORD *)(v11 + 20);
    result = (PMDL)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v11);
    if( result )
      goto LABEL_3;
    ++*(_DWORD *)(v11 + 24);
    v14 = *((_QWORD *)CurrentPrcb + 263);
    ++*(_DWORD *)(v14 + 20);
    result = (PMDL)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v14);
    if( result
      || (v15 = *(unsigned int *)(v14 + 44),
          v16 = *(__int64(__fastcall **)(__int64, __int64, __int64))(v14 + 48),
          v17 = *(unsigned int *)(v14 + 40),
          v18 = *(unsigned int *)(v14 + 36),
          ++*(_DWORD *)(v14 + 24),
          (result = (PMDL)v16(v18, v15, v17)) != 0i64) )
    {
LABEL_3:
      LODWORD(result->Next) = *((_DWORD *)CurrentPrcb + 9);
    }
    if( result )
    {
      LOWORD(v13) = result->Next;
      goto LABEL_6;
    }
    v19 = 184;
  }
  result = (PMDL)ExAllocatePoolWithTag(NonPagedPoolNx, v19, 0x206C644Dui64);
  if( !result )
    return result;
  v13 = *((_DWORD *)KeGetPcr() + 105);
LABEL_6:
  result->AllocationProcessorNumber = v13;
  result->Next = 0i64;
  result->Size = 8 * (v9 + 6);
  result->StartVa = (void *)((unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFFF000ui64);
  result->ByteOffset = v5 & 0xFFF;
  result->ByteCount = Length;
  result->MdlFlags = v8;
  if( Irp )
  {
    if( SecondaryBuffer )
    {
      v20 = (_QWORD **)*((_QWORD *)Irp + 1);
      for( i = *v20; i; i = (_QWORD *)*i )
        v20 = (_QWORD **)i;
      *v20 = &result->Next;
    }
    else
    {
      *((_QWORD *)Irp + 1) = result;
    }
  }
  return result;
}

Referenced by: