MiGetCcAccessLog

_MM_PAGE_ACCESS_INFO_HEADER *__stdcall MiGetCcAccessLog(_FILE_OBJECT *FileObject, UINT64 EntryCount){
  __int64 v4; 
  UINT64 v5; 
  __int64 v6; 
  unsigned __int64 v7; 
  void *FsContext; 
  void **v9; 
  _MM_PAGE_ACCESS_INFO_HEADER *result; 
  UINT64 v11; 
  VOID *v12; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  _MM_PAGE_ACCESS_INFO_HEADER *v14; 

  if( !*(&stru_140C4DB30 + 322) )
    goto LABEL_12;
  v4 = _InterlockedExchange64((_QWORD *)&stru_140C4DB30 + 322, 0i64);
  if( !v4 )
    goto LABEL_12;
  v5 = *(_QWORD *)(v4 + 40);
  if( *(_QWORD *)(v4 + 32) + 8 * EntryCount > v5
    || (__int64)((*(_QWORD *)(v4 + 48) - v5) & 0xFFFFFFFFFFFFFFF8ui64) >= 4096 )
  {
    MiQueuePageAccessLog((_MM_PAGE_ACCESS_INFO_HEADER *)v4);
    v4 = 0i64;
  }
  if( !v4 )
  {
LABEL_12:
    v11 = (8 * EntryCount + 4183) & 0xFFFFFFFFFFFFF000ui64;
    result = (_MM_PAGE_ACCESS_INFO_HEADER *)MiAllocatePool(64i64, v11, 0x63416D4Dui64);
    if( !result )
      return result;
    AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemCache, v12);
    MiInitializePageAccessLogging(AnyMultiplexedVm, v14, v11);
    *(_DWORD *)(v4 + 8) = 1;
  }
  v6 = *(_QWORD *)(v4 + 40);
  v7 = *(_QWORD *)(v4 + 48);
  FsContext = FileObject->FsContext;
  v9 = (void **)(v6 + 8);
  if( v6 + 8 >= v7 )
    goto LABEL_11;
  do
  {
    if( *v9 == FsContext )
      break;
    ++v9;
  }
  while( (unsigned __int64)v9 < v7 );
  if( (unsigned __int64)v9 >= v7 )
  {
LABEL_11:
    v9 = *(void ***)(v4 + 40);
    *(_QWORD *)(v4 + 40) = v6 - 8;
    *v9 = FsContext;
  }
  *(_QWORD *)(v4 + 24) = *(_QWORD *)(v4 + 32);
  result = (_MM_PAGE_ACCESS_INFO_HEADER *)v4;
  *(_DWORD *)(v4 + 12) = (__int64)(v7 - (_QWORD)v9) >> 3;
  return result;
}

Referenced by: