VfGetScatterGatherList

__int64 VfGetScatterGatherList(ULONG_PTR a1, __int64 a2, ...){
  UINT64 v2; 
  PMDL v3; 
  _QWORD *v5; 
  __int64(__fastcall *v6)(ULONG_PTR, __int64, PMDL, UINT64, unsigned int, VOID(__fastcall *)(_DEVICE_OBJECT *, _IRP *, _SCATTER_GATHER_LIST *, VOID *), __int64, _BYTE); 
  INT64 v7; 
  LIST_ENTRY *AdapterInformationInternal; 
  unsigned int v9; 
  __int64 v10; 
  unsigned int v12; 
  unsigned int v13; 
  _QWORD *v14; 
  __int64 v15; 
  int ByteOffset; 
  __int64 v17; 
  PMDL v18; 
  unsigned int v19; 
  unsigned int ByteCount; 
  int v21; 
  int v22; 
  unsigned int v23; 
  UINT64 v24; 
  CHAR *MapRegisterFile; 
  struct _SLIST_ENTRY *v26; 
  _OWORD *v27; 
  VOID(__fastcall *v28)(_DEVICE_OBJECT *, _IRP *, _SCATTER_GATHER_LIST *, VOID *); 
  int v29; 
  unsigned int v30; 
  UINT64 v31; 
  UINT64 *v32; 
  unsigned __int8 v33; 
  unsigned __int64 v34; 
  __int64 v35; 
  _QWORD *v36; 
  CHAR Param3; 
  UINT64 v38; 
  struct _SLIST_ENTRY *v39; 
  VOID *MapRegisterBase; 
  __int64(__fastcall *v41)(ULONG_PTR, __int64, PMDL, UINT64, unsigned int, VOID(__fastcall *)(_DEVICE_OBJECT *, _IRP *, _SCATTER_GATHER_LIST *, VOID *), __int64, _BYTE); 
  PMDL MemoryDescriptorList; 
  va_list MemoryDescriptorLista; 
  UINT64 v46; 
  va_list va1; 
  UINT64 Size; 
  VOID(__fastcall *v49)(_DEVICE_OBJECT *, _IRP *, _SCATTER_GATHER_LIST *, VOID *); 
  __int64 v50; 
  __int64 v51; 
  va_list va2; 
  va_start(va2, a2);
  va_start(va1, a2);
  va_start(MemoryDescriptorLista, a2);
  MemoryDescriptorList = va_arg(va1, PMDL);
  va_copy(va2, va1);
  v46 = va_arg(va2, _QWORD);
  Size = va_arg(va2, _QWORD);
  v49 = va_arg(
          va2,
          VOID(__fastcall *)(_DEVICE_OBJECT *DeviceObject, _IRP *Irp, _SCATTER_GATHER_LIST *ScatterGather, VOID *Context));
  v50 = va_arg(va2, _QWORD);
  v51 = va_arg(va2, _QWORD);
  v2 = v46;
  v3 = MemoryDescriptorList;
  v39 = 0i64;
  v5 = 0i64;
  LODWORD(v6) = ViGetRealDmaOperation((_DMA_ADAPTER *)a1, 0x58ui64);
  LOBYTE(v7) = 1;
  v41 = v6;
  AdapterInformationInternal = ViGetAdapterInformationInternal((DMA_ADAPTER *)a1, v7);
  v9 = Size;
  v10 = (__int64)AdapterInformationInternal;
  if( !AdapterInformationInternal )
    goto LABEL_19;
  VF_ASSERT_IRQL(2u);
  if( !v3 )
    return 3221225485i64;
  _InterlockedIncrement((volatile signed __int32 *)(v10 + 164));
  _InterlockedIncrement((volatile signed __int32 *)(v10 + 168));
  v3 = MemoryDescriptorList;
  VERIFY_BUFFER_LOCKED(MemoryDescriptorList);
  if( *(_DWORD *)(v10 + 192) == 3 )
  {
    v12 = ViCheckMdlLength(v3, 0i64, v9);
    if( v12 )
    {
      v13 = v12;
      ViHalPreprocessOptions(
        &byte_140C12D10,
        (PSTR)"The provided MDL is not sufficient to satisfy the requested length",
        0x24ui64,
        v12,
        0i64,
        0i64,
        v38);
      VfReportIssueWithOptions(0xE6ui64, 0x24ui64, v13, 0i64, 0i64, &byte_140C12D10);
    }
  }
  LODWORD(v14) = ExAllocateFromNPagedLookasideList((NPAGED_LOOKASIDE_LIST *)ViHalWaitBlockLookaside);
  v2 = v46;
  v5 = v14;
  if( v14 )
  {
    v14[8] = 0i64;
    v15 = v50;
    *v14 = v50;
    ByteOffset = v2 & 0xFFF;
    v17 = (__int64)v49;
    v18 = v3;
    v5[10] = v5 + 9;
    v5[9] = v5 + 9;
    v5[1] = v17;
    v19 = LODWORD(v3->StartVa) + v3->ByteOffset + v3->ByteCount - v2;
    ByteCount = v19;
    v21 = 0;
    while( v19 < v9 )
    {
      v18 = v18->Next;
      if( !v18 )
        break;
      v22 = ByteOffset + 4095;
      ByteOffset = v18->ByteOffset;
      v23 = ByteCount + v22;
      ByteCount = v18->ByteCount;
      v21 += v23 >> 12;
      v19 += ByteCount;
    }
    if( v19 + 4096 < ByteOffset + v9 )
    {
      DECREMENT_SCATTER_GATHER_LISTS(v10);
      ExFreeToNPagedLookasideList((NPAGED_LOOKASIDE_LIST *)ViHalWaitBlockLookaside, v5);
      return 3221225507i64;
    }
    v5[7] = v10;
    v24 = v21 + ((ByteOffset + ByteCount - v19 + v9 + 4095) >> 12);
    *((_DWORD *)v5 + 12) = v24;
    MapRegisterFile = ViAllocateMapRegisterFile(v10, v24);
    MapRegisterBase = MapRegisterFile;
    v26 = (struct _SLIST_ENTRY *)MapRegisterFile;
    if( MapRegisterFile )
    {
      MapRegisterFile[25] = 1;
      v5[12] = MapRegisterFile;
      v5[2] = v5 + 13;
      Param3 = v51;
      v5[3] = v2;
      *((_DWORD *)v5 + 8) = v9;
      if( (unsigned int)ViMapDoubleBuffer((UINT64)MapRegisterFile, (UINT64)v3, v2, v9, Param3) )
      {
        v27 = (_OWORD *)v5[2];
        v39 = v26;
        v15 = (__int64)v5;
        *v27 = *(_OWORD *)&v3->Next;
        v27[1] = *(_OWORD *)&v3->Process;
        v27[2] = *(_OWORD *)&v3->StartVa;
        ViSwap(&MapRegisterBase, (_MDL **)MemoryDescriptorLista, (VOID **)va1);
        v2 = v46;
        v28 = ViScatterGatherCallback;
        v3 = MemoryDescriptorList;
        goto LABEL_21;
      }
      ViFreeMapRegisterFile(v10, v26);
    }
    ExFreeToNPagedLookasideList((NPAGED_LOOKASIDE_LIST *)ViHalWaitBlockLookaside, v5);
    v5 = 0i64;
  }
  else
  {
LABEL_19:
    v15 = v50;
  }
  v28 = v49;
LABEL_21:
  v29 = v41(a1, a2, v3, v2, v9, v28, v15, v51);
  v30 = v29;
  if( v10 && v29 < 0 )
  {
    DECREMENT_SCATTER_GATHER_LISTS(v10);
    if( v39 )
      ViFreeMapRegisterFile(v10, v39);
    if( v5 )
    {
      v32 = (UINT64 *)(v10 + 72);
      KeAcquireSpinLockRaiseToDpc((UINT64 *)(v10 + 72), v31);
      v34 = v33;
      v35 = v5[9];
      v36 = (_QWORD *)v5[10];
      if( *(_QWORD **)(v35 + 8) != v5 + 9 || (_QWORD *)*v36 != v5 + 9 )
        __fastfail(3u);
      *v36 = v35;
      *(_QWORD *)(v35 + 8) = v36;
      KxReleaseSpinLock(v32);
      __writecr8(v34);
      ExFreeToNPagedLookasideList((NPAGED_LOOKASIDE_LIST *)ViHalWaitBlockLookaside, v5);
    }
  }
  return v30;
}

Referenced by: