WheapPredictiveFailureAnalysis

VOID __stdcall WheapPredictiveFailureAnalysis(_WHEAP_ERROR_RECORD_WRAPPER *Wrapper){
  _WHEA_ERROR_RECORD *p_ErrorRecord; 
  char v3; 
  unsigned int v4; 
  _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR *SectionDescriptor; 
  _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR *v6; 
  _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR *v7; 
  __int64 v8; 
  _WHEAP_ERROR_RECORD_WRAPPER_FLAGS v9; 
  _DEVICE_OBJECT *v10; 
  _BYTE *v11; 
  __int64 v12; 
  _UNICODE_STRING *v13; 
  _BYTE *v14; 

  p_ErrorRecord = &Wrapper->ErrorRecord;
  if( (unsigned int)PshedDoPfa(&Wrapper->ErrorRecord) != 1
    && !WheapPolicyDisableOffline
    && *(&WheapErrorSourceTable + 60)
    && p_ErrorRecord->Header.SectionCount
    && p_ErrorRecord->Header.Severity == WheaErrSevCorrected
    && (*(_BYTE *)&p_ErrorRecord->Header.Flags.0 & 1) == 0 )
  {
    v3 = 0;
    v4 = 0;
    SectionDescriptor = p_ErrorRecord->SectionDescriptor;
    while( 1 )
    {
      v6 = SectionDescriptor;
      if( (*(_BYTE *)&SectionDescriptor->Flags.0 & 1) != 0 )
        break;
      ++v4;
      ++SectionDescriptor;
      if( v4 >= p_ErrorRecord->Header.SectionCount )
        goto LABEL_13;
    }
    v3 = 1;
LABEL_13:
    v7 = p_ErrorRecord->SectionDescriptor;
    if( v3 )
      v7 = v6;
    v8 = *(_QWORD *)&v7->SectionType.Data1 - *(_QWORD *)&MEMORY_ERROR_SECTION_GUID.Data1;
    if( !v8 )
      v8 = *(_QWORD *)v7->SectionType.Data4 - *(_QWORD *)MEMORY_ERROR_SECTION_GUID.Data4;
    if( !v8 )
    {
      v9.0 = ($978CB274F65821CF87196E7A5560085B)Wrapper->Flags;
      v10 = (_DEVICE_OBJECT *)((char *)p_ErrorRecord + v7->SectionOffset);
      if( (*(_BYTE *)&v9.0 & 4) != 0 )
      {
        if( (*(_BYTE *)&v9.0 & 8) != 0 && (v10->Type & 2) != 0 )
          WheaAttemptPhysicalPageOffline((unsigned __int64)v10->NextDevice >> 12, 1u, 0);
      }
      else
      {
        v11 = KeAbPreAcquire((char *)&stru_140CF2E80 + 6400, 0i64, 0i64);
        v14 = v11;
        if( _interlockedbittestandset64((volatile signed __int32 *)&stru_140CF2E80 + 1600, 0i64) )
          ExfAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&stru_140CF2E80 + 800, v11, (char *)&stru_140CF2E80 + 6400);
        if( v14 )
          v14[26] |= 1u;
        WheapPfaMemoryCheck(v12, v10, v13);
        if( (_InterlockedExchangeAdd64((_QWORD *)&stru_140CF2E80 + 800, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((_EX_PUSH_LOCK *)&stru_140CF2E80 + 800);
        KeAbPostRelease((char *)&stru_140CF2E80 + 6400);
      }
    }
  }
}

Referenced by: