MiAllocateAccessLog

_MM_PAGE_ACCESS_INFO_HEADER *__stdcall MiAllocateAccessLog(_MMSUPPORT_INSTANCE *Vm){
  INT64 v2; 
  UINT64 v3; 
  _MM_PAGE_ACCESS_INFO_HEADER **AgeDistribution; 
  _MM_PAGE_ACCESS_INFO_HEADER *v5; 
  UINT64 v6; 
  _MM_PAGE_ACCESS_INFO_HEADER *PoolMm; 
  _MM_PAGE_ACCESS_INFO_HEADER *v8; 
  _MM_PAGE_ACCESS_INFO_HEADER *result; 
  _SINGLE_LIST_ENTRY *Next; 

  v2 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * Vm->PartitionId);
  if( MiSufficientAvailablePages(v2, 0x420ui64)
    && *(__int64 *)(v2 + 7168) >= 1056
    && (unsigned __int64)(MiState[0] - qword_140C4C608) >= 0x800 )
  {
    v3 = 4096i64;
  }
  else
  {
    v3 = 512i64;
  }
  if( (Vm->Flags._bf_0 & 7) == 2 )
    AgeDistribution = (_MM_PAGE_ACCESS_INFO_HEADER **)((char *)&stru_140C4DB30 + 6584);
  else
    AgeDistribution = (_MM_PAGE_ACCESS_INFO_HEADER **)Vm[1].AgeDistribution;
  v5 = *AgeDistribution;
  if( *AgeDistribution )
  {
    Next = v5->Link.Next;
    if( v3 == 512 || Next && Next->Next )
    {
      MiEmptyPageAccessLog(*AgeDistribution);
      v5 = 0i64;
      *AgeDistribution = 0i64;
    }
  }
  do
  {
    v6 = KeGetCurrentPrcb()->ParentNode->Affinity.Reserved[0];
    LODWORD(v6) = v6 | 0x80000000;
    PoolMm = (_MM_PAGE_ACCESS_INFO_HEADER *)ExAllocatePoolMm(64i64, v3, 0x63416D4Dui64, v6);
    if( PoolMm )
    {
      *AgeDistribution = PoolMm;
      MiInitializePageAccessLogging(Vm, PoolMm, v3);
      result = v8;
      v8->Link.Next = &v5->Link;
      return result;
    }
    if( *AgeDistribution )
    {
      MiEmptyPageAccessLog(*AgeDistribution);
      v5 = 0i64;
      *AgeDistribution = 0i64;
    }
    v3 >>= 1;
  }
  while( v3 >= 0x200 );
  return 0i64;
}

Referenced by: