WheapPredictiveFailureAnalysis

VOID __stdcall WheapPredictiveFailureAnalysis(_WHEAP_ERROR_RECORD_WRAPPER *Wrapper){
  _WHEA_ERROR_RECORD *p_ErrorRecord; 
  char v3; 
  unsigned int v4; 
  _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR *SectionDescriptor; 
  _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR *v6; 
  _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR *v7; 
  __int64 v8; 
  _WHEAP_ERROR_RECORD_WRAPPER_FLAGS v9; 
  INT64 v10; 
  _BYTE *v11; 
  LARGE_INTEGER v12; 
  _BYTE *v13; 
  p_ErrorRecord = &Wrapper->ErrorRecord;
  if( (unsigned int)PshedDoPfa(&Wrapper->ErrorRecord) != 1
    && !WheapPolicyDisableOffline
    && WheapPfaInitialized
    && p_ErrorRecord->Header.SectionCount
    && p_ErrorRecord->Header.Severity == WheaErrSevCorrected
    && (*(_BYTE *)&p_ErrorRecord->Header.Flags.0 & 1) == 0 )
  {
    v3 = 0;
    v4 = 0;
    SectionDescriptor = p_ErrorRecord->SectionDescriptor;
    while( 1 )
    {
      v6 = SectionDescriptor;
      if( (*(_BYTE *)&SectionDescriptor->Flags.0 & 1) != 0 )
        break;
      ++v4;
      ++SectionDescriptor;
      if( v4 >= p_ErrorRecord->Header.SectionCount )
        goto LABEL_13;
    }
    v3 = 1;
LABEL_13:
    v7 = p_ErrorRecord->SectionDescriptor;
    if( v3 )
      v7 = v6;
    v8 = *(_QWORD *)&v7->SectionType.Data1 - *(_QWORD *)&MEMORY_ERROR_SECTION_GUID.Data1;
    if( !v8 )
      v8 = *(_QWORD *)v7->SectionType.Data4 - *(_QWORD *)MEMORY_ERROR_SECTION_GUID.Data4;
    if( !v8 )
    {
      v9.0 = ($978CB274F65821CF87196E7A5560085B)Wrapper->Flags;
      v10 = (INT64)p_ErrorRecord + v7->SectionOffset;
      if( (*(_BYTE *)&v9.0 & 4) != 0 )
      {
        if( (*(_BYTE *)&v9.0 & 8) != 0 && (*(_BYTE *)v10 & 2) != 0 )
          WheaAttemptPhysicalPageOffline(*(_QWORD *)(v10 + 16) >> 12, 1u, 0);
      }
      else
      {
        LODWORD(v11) = KeAbPreAcquire(&WheapPfaLock, 0i64, 0i64);
        v13 = v11;
        if( _interlockedbittestandset64((volatile signed __int32 *)&WheapPfaLock, 0i64) )
          ExfAcquirePushLockExclusiveEx(&WheapPfaLock, v11, &WheapPfaLock);
        if( v13 )
          v13[26] |= 1u;
        WheapPfaMemoryCheck(v12, v10);
        if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&WheapPfaLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((volatile INT64 *)&WheapPfaLock);
        KeAbPostRelease(&WheapPfaLock);
      }
    }
  }
}

Referenced by: