WheapPfaMemoryCheck

int __fastcall WheapPfaMemoryCheck(__int64 a1, _DEVICE_OBJECT *a2, _UNICODE_STRING *a3){
  VOID **PoolWithTag; 
  _LARGE_INTEGER NextDevice; 
  UINT64 v5; 
  INT64 v6; 
  VOID **v7; 
  unsigned int v8; 
  VOID ***v9; 
  VOID ***v10; 
  __int64 v11; 
  _QWORD *v12; 
  bool v13; 
  void *retaddr; 
  _LARGE_INTEGER v16; 

  PoolWithTag = &retaddr;
  v16.QuadPart = a1;
  if( !WheapPolicyMemPfaDisable && (a2->Type & 2) != 0 )
  {
    NextDevice = (_LARGE_INTEGER)a2->NextDevice;
    v16 = NextDevice;
    LODWORD(PoolWithTag) = MmGetPageBadStatus(&v16);
    if( !(_DWORD)PoolWithTag )
    {
      v5 = (unsigned __int64)NextDevice.QuadPart >> 12;
      v6 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
      WheapPfaRetireExpiredMemoryEntries(*(UINT64 *)&KUSER_SHARED_DATA.InterruptTime.LowPart);
      v7 = (VOID **)*(&stru_140CF2E80 + 801);
      v8 = 0;
      if( (_UNKNOWN *)*(&stru_140CF2E80 + 801) == (_UNKNOWN *)((char *)&stru_140CF2E80 + 6408) )
      {
LABEL_7:
        if( v8 >= WheapPolicyMemPfaPageCount )
        {
          v7 = (VOID **)*(&stru_140CF2E80 + 802);
          v11 = **(&stru_140CF2E80 + 802);
          if( *(_QWORD *)(**(&stru_140CF2E80 + 802) + 8i64) != *(&stru_140CF2E80 + 802) )
            goto LABEL_21;
          v12 = *(_QWORD **)(*(&stru_140CF2E80 + 802) + 8i64);
          if( *v12 != *(&stru_140CF2E80 + 802) )
            goto LABEL_21;
          *v12 = v11;
          *(_QWORD *)(v11 + 8) = v12;
          WheapPfaLogPageMonitorRemoval((INT64)v7, 3i64, v6);
        }
        else
        {
          PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x30ui64, 1634035799i64);
          v7 = PoolWithTag;
          if( !PoolWithTag )
            return(int)PoolWithTag;
        }
        *v7 = 0i64;
        v7[1] = 0i64;
        *(_DWORD *)((char *)v7 + 18) = 0;
        *((_WORD *)v7 + 11) = 0;
        *((_WORD *)v7 + 8) = 0;
        v7[3] = (VOID *)v6;
        v7[5] = (VOID *)v5;
      }
      else
      {
        while( 1 )
        {
          v9 = (VOID ***)*v7;
          if( v7[5] == (VOID *)v5 )
            break;
          ++v8;
          v7 = (VOID **)*v7;
          if( v9 == (VOID ***)((char *)&stru_140CF2E80 + 6408) )
            goto LABEL_7;
        }
        if( v9[1] != v7 )
          goto LABEL_21;
        v10 = (VOID ***)v7[1];
        if( *v10 != v7 )
          goto LABEL_21;
        *v10 = (VOID **)v9;
        v9[1] = (VOID **)v10;
      }
      v13 = (unsigned __int16)++*((_WORD *)v7 + 8) < (unsigned int)WheapPolicyMemPfaThreshold;
      v7[4] = (VOID *)v6;
      if( !v13 )
      {
        WheapPfaLogPageMonitorRemoval((INT64)v7, 1i64, v6);
        WheaAttemptPhysicalPageOffline(v5, 0, 0);
        LODWORD(PoolWithTag) = (unsigned int)ExFreePoolWithTag(v7, 0x61656857u);
        return(int)PoolWithTag;
      }
      PoolWithTag = (VOID **)*(&stru_140CF2E80 + 801);
      if( *(_UNKNOWN **)(*(&stru_140CF2E80 + 801) + 8i64) == (_UNKNOWN *)((char *)&stru_140CF2E80 + 6408) )
      {
        *v7 = (VOID *)*(&stru_140CF2E80 + 801);
        v7[1] = (char *)&stru_140CF2E80 + 6408;
        PoolWithTag[1] = v7;
        *(&stru_140CF2E80 + 801) = v7;
        return(int)PoolWithTag;
      }
LABEL_21:
      __fastfail(3u);
    }
  }
  return(int)PoolWithTag;
}

Referenced by: