MiAllocateAccessLog

UINT64 **__fastcall MiAllocateAccessLog(INT64 a1){
  INT64 v2; 
  UINT64 v3; 
  UINT64 **v4; 
  UINT64 *v5; 
  UINT64 v6; 
  UINT64 *PoolMm; 
  UINT64 **v8; 
  UINT64 **result; 
  _QWORD *v10; 
  v2 = *(_QWORD *)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(a1 + 174));
  if( (unsigned int)MiSufficientAvailablePages(v2, 0x420ui64)
    && *(__int64 *)(v2 + 7168) >= 1056
    && (unsigned __int64)(*(_QWORD *)MiState - qword_140C4C608) >= 0x800 )
  {
    v3 = 4096i64;
  }
  else
  {
    v3 = 512i64;
  }
  if( (*(_BYTE *)(a1 + 184) & 7) == 2 )
    v4 = (UINT64 **)qword_140C4F4E8;
  else
    v4 = (UINT64 **)(a1 + 232);
  v5 = *v4;
  if( *v4 )
  {
    v10 = (_QWORD *)*v5;
    if( v3 == 512 || v10 && *v10 )
    {
      MiEmptyPageAccessLog(*v4);
      v5 = 0i64;
      *v4 = 0i64;
    }
  }
  do
  {
    v6 = *(unsigned __int16 *)(*((_QWORD *)KeGetCurrentPrcb() + 24) + 146i64);
    LODWORD(v6) = v6 | 0x80000000;
    PoolMm = (UINT64 *)ExAllocatePoolMm(64i64, v3, 0x63416D4Dui64, v6);
    if( PoolMm )
    {
      *v4 = PoolMm;
      MiInitializePageAccessLogging(a1, (INT64)PoolMm, v3);
      result = v8;
      *v8 = v5;
      return result;
    }
    if( *v4 )
    {
      MiEmptyPageAccessLog(*v4);
      v5 = 0i64;
      *v4 = 0i64;
    }
    v3 >>= 1;
  }
  while( v3 >= 0x200 );
  return 0i64;
}

Referenced by: