MmIdentifyPhysicalMemory

VOID __fastcall MmIdentifyPhysicalMemory(UINT64 LoggerId, INT64 HookId, UINT64 LogActive){
  int v3; 
  unsigned int v4; 
  PFN_WDFREGISTRYQUERYULONG *v5; 
  int v6; 
  unsigned int v7; 
  PHYSICAL_MEMORY_DESCRIPTOR *v8; 
  _MMPFN *v9; 
  unsigned __int64 v10; 
  PFN_WDFREGISTRYQUERYULONG *v11; 
  __int64 v12; 
  __int64 v13; 
  __int64 v14; 
  INT64 v15; 
  INT16 v16; 
  _MMPFN_IDENTITY Identity[5]; 
  char *v18; 
  int v19; 
  PFN_WDFREGISTRYQUERYULONG *v20; 
  unsigned __int64 v21; 
  PHYSICAL_MEMORY_DESCRIPTOR *v22; 
  __int64 v23[3]; 
  PGET_UPDATED_BUS_RESOURCE v24[2]; 

  Identity[0] = HookId;
  v20 = (PFN_WDFREGISTRYQUERYULONG *)LoggerId;
  v23[0] = 0i64;
  v4 = HookId;
  v5 = (PFN_WDFREGISTRYQUERYULONG *)LoggerId;
  v18 = 0i64;
  v19 = v3;
  v16 = LogActive;
  *(_OWORD *)&Identity[1] = 0i64;
  v6 = v3;
  *(_OWORD *)v24 = 0i64;
  v7 = 0;
  v22 = MiReferencePageRuns((ULONG_PTR *)&Irp.Core.PartitionId, 0i64);
  v8 = v22;
  if( v22->NumberOfRuns )
  {
    do
    {
      v9 = &MmGetPfnDb()[v8->Run[v7].BasePage];
      v10 = (unsigned __int64)&v9[v8->Run[v7].PageCount];
      v21 = v10;
      if( (unsigned __int64)v9 < v10 )
      {
        v11 = v20;
        do
        {
          v12 = 1i64;
          if( !v6 || (v9->u4._bf_0 & 0x1000000000i64) != 0 || (*(_BYTE *)(&v9->u3 + 1) & 7) == 6 )
          {
            *(_OWORD *)&Identity[1] = 0i64;
            v18 = 0i64;
            MiIdentifyPfnWrapper(v9, &Identity[1]);
            v12 = v13;
            if( !v6 || (Identity[1] & 0x70) == 96 )
            {
              if( v13 )
              {
                v14 = v13;
                v24[0] = (PGET_UPDATED_BUS_RESOURCE)&Identity[1];
                v24[1] = (PGET_UPDATED_BUS_RESOURCE)24;
                do
                {
                  LODWORD(v15) = 4200450;
                  EtwTraceSiloDcEvent(v24, 1ui64, v11, (unsigned int)Identity[0], v16, v15);
                  ++*(_QWORD *)&Identity[3];
                  if( (Identity[1] & 0xF) == 2 )
                  {
                    v18 += 8;
                  }
                  else if( v18 && v18 != MmBadPointer )
                  {
                    v18 += 4096;
                  }
                  --v14;
                }
                while( v14 );
                v10 = v21;
                v6 = v19;
              }
            }
          }
          v9 += v12;
        }
        while( (unsigned __int64)v9 < v10 );
        v8 = v22;
      }
      ++v7;
    }
    while( v7 < v8->NumberOfRuns );
    v5 = v20;
    v4 = Identity[0];
  }
  MiDereferencePageRuns(v8);
  if( !v6 )
  {
    LODWORD(v23[0]) &= 0xFFFFFFE0;
    v23[1] = (__int64)MmPfnDatabase;
    v23[2] = MxPfnAllocation;
    v24[0] = (PGET_UPDATED_BUS_RESOURCE)v23;
    LODWORD(v15) = 4200450;
    v24[1] = (PGET_UPDATED_BUS_RESOURCE)24;
    EtwTraceSiloDcEvent(v24, 1ui64, v5, v4, 635, v15);
  }
}

Referenced by: