WheapPfaMemoryCheck

VOID __fastcall WheapPfaMemoryCheck(LARGE_INTEGER a1, INT64 a2){
  _UNICODE_STRING *v2; 
  LARGE_INTEGER v3; 
  UINT64 v4; 
  INT64 v5; 
  char *PoolWithTag; 
  unsigned int v7; 
  PVOID *v8; 
  VOID **v9; 
  __int64 v10; 
  _QWORD *v11; 
  bool v12; 
  _QWORD *v13; 
  LARGE_INTEGER v14; 
  v14 = a1;
  if( !WheapPolicyMemPfaDisable && (*(_BYTE *)a2 & 2) != 0 )
  {
    v3 = *(LARGE_INTEGER *)(a2 + 16);
    v14 = v3;
    if( !MmGetPageBadStatus(&v14, (_DEVICE_OBJECT *)a2, v2) )
    {
      v4 = (unsigned __int64)v3.QuadPart >> 12;
      v5 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
      WheapPfaRetireExpiredMemoryEntries(*(UINT64 *)&KUSER_SHARED_DATA.InterruptTime.LowPart);
      PoolWithTag = (char *)WheapPfaList;
      v7 = 0;
      if( WheapPfaList == &WheapPfaList )
      {
LABEL_7:
        if( v7 >= WheapPolicyMemPfaPageCount )
        {
          PoolWithTag = (char *)qword_140CF4790;
          v10 = *(_QWORD *)qword_140CF4790;
          if( *(_QWORD *)(*(_QWORD *)qword_140CF4790 + 8i64) != qword_140CF4790 )
            goto LABEL_21;
          v11 = *(_QWORD **)(qword_140CF4790 + 8);
          if( *v11 != qword_140CF4790 )
            goto LABEL_21;
          *v11 = v10;
          *(_QWORD *)(v10 + 8) = v11;
          WheapPfaLogPageMonitorRemoval((INT64)PoolWithTag, 3i64, v5);
        }
        else
        {
          PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, 0x30ui64, 0x61656857ui64);
          if( !PoolWithTag )
            return;
        }
        *(_QWORD *)PoolWithTag = 0i64;
        *((_QWORD *)PoolWithTag + 1) = 0i64;
        *(_DWORD *)(PoolWithTag + 18) = 0;
        *((_WORD *)PoolWithTag + 11) = 0;
        *((_WORD *)PoolWithTag + 8) = 0;
        *((_QWORD *)PoolWithTag + 3) = v5;
        *((_QWORD *)PoolWithTag + 5) = v4;
      }
      else
      {
        while( 1 )
        {
          v8 = *(PVOID **)PoolWithTag;
          if( *((_QWORD *)PoolWithTag + 5) == v4 )
            break;
          ++v7;
          PoolWithTag = *(char **)PoolWithTag;
          if( v8 == &WheapPfaList )
            goto LABEL_7;
        }
        if( v8[1] != PoolWithTag )
          goto LABEL_21;
        v9 = (VOID **)*((_QWORD *)PoolWithTag + 1);
        if( *v9 != PoolWithTag )
          goto LABEL_21;
        *v9 = v8;
        v8[1] = v9;
      }
      v12 = (unsigned __int16)++*((_WORD *)PoolWithTag + 8) < (unsigned int)WheapPolicyMemPfaThreshold;
      *((_QWORD *)PoolWithTag + 4) = v5;
      if( v12 )
      {
        v13 = WheapPfaList;
        if( *((PVOID **)WheapPfaList + 1) == &WheapPfaList )
        {
          *(_QWORD *)PoolWithTag = WheapPfaList;
          *((_QWORD *)PoolWithTag + 1) = &WheapPfaList;
          v13[1] = PoolWithTag;
          WheapPfaList = PoolWithTag;
          return;
        }
LABEL_21:
        __fastfail(3u);
      }
      WheapPfaLogPageMonitorRemoval((INT64)PoolWithTag, 1i64, v5);
      WheaAttemptPhysicalPageOffline(v4, 0, 0);
      ExFreePoolWithTag(PoolWithTag, 0x61656857u);
    }
  }
}

Referenced by: