MmIdentifyPhysicalMemory

INT64 __stdcall MmIdentifyPhysicalMemory(UINT64 LoggerId, UINT16 HookId, UINT64 LogActive){
  int v3; 
  unsigned int v4; 
  UINT64 v5; 
  int v6; 
  unsigned int v7; 
  _PHYSICAL_MEMORY_DESCRIPTOR *v8; 
  _MMPFN *v9; 
  unsigned __int64 v10; 
  UINT64 v11; 
  __int64 v12; 
  __int64 v13; 
  __int64 v14; 
  INT64 a6; 
  INT16 a5; 
  unsigned int a4; 
  _MMPFN_IDENTITY a4_4; 
  int v20; 
  UINT64 a3; 
  unsigned __int64 v22; 
  PHYSICAL_MEMORY_DESCRIPTOR *v23; 
  __int64 v24[3]; 
  EVENT_DATA_DESCRIPTOR a1; 
  a4 = HookId;
  a3 = LoggerId;
  v24[0] = 0i64;
  v4 = HookId;
  v5 = LoggerId;
  v20 = v3;
  a5 = LogActive;
  memset(&a4_4, 0, sizeof(a4_4));
  v6 = v3;
  a1 = 0i64;
  v7 = 0;
  v23 = MiReferencePageRuns((_MI_PARTITION *)&MiSystemPartition, 0i64);
  v8 = v23;
  if( v23->NumberOfRuns )
  {
    do
    {
      v9 = (_MMPFN *)((char *)MmGetPfnDb() + 48 * v8->Run[v7].BasePage);
      v10 = (unsigned __int64)v9 + 48 * v8->Run[v7].PageCount;
      v22 = v10;
      if( (unsigned __int64)v9 < v10 )
      {
        v11 = a3;
        do
        {
          v12 = 1i64;
          if( !v6 || (*((_QWORD *)v9 + 5) & 0x1000000000i64) != 0 || (*((_BYTE *)v9 + 34) & 7) == 6 )
          {
            memset(&a4_4, 0, sizeof(a4_4));
            MiIdentifyPfnWrapper(v9, &a4_4);
            v12 = v13;
            if( !v6 || (*(_BYTE *)&a4_4.u1.e1 & 0x70) == 96 )
            {
              if( v13 )
              {
                a1.Reserved = 0;
                v14 = v13;
                a1.Ptr = (unsigned __int64)&a4_4;
                a1.Size = 24;
                do
                {
                  LODWORD(a6) = 4200450;
                  EtwTraceSiloDcEvent(&a1, 1u, v11, a4, a5, a6);
                  ++a4_4.PageFrameIndex;
                  if( (*(_BYTE *)&a4_4.u1.e1 & 0xF) == 2 )
                  {
                    a4_4.u2.FileObject = (char *)a4_4.u2.FileObject + 8;
                  }
                  else if( a4_4.u2.FileObject && a4_4.u2.FileObject != MmBadPointer )
                  {
                    a4_4.u2.FileObject = (char *)a4_4.u2.FileObject + 4096;
                  }
                  --v14;
                }
                while( v14 );
                v10 = v22;
                v6 = v20;
              }
            }
          }
          v9 = (_MMPFN *)((char *)v9 + 48 * v12);
        }
        while( (unsigned __int64)v9 < v10 );
        v8 = v23;
      }
      ++v7;
    }
    while( v7 < v8->NumberOfRuns );
    v5 = a3;
    v4 = a4;
  }
  MiDereferencePageRuns(v8);
  if( !v6 )
  {
    LODWORD(v24[0]) &= 0xFFFFFFE0;
    a1.Reserved = 0;
    v24[1] = MmPfnDatabase;
    v24[2] = MxPfnAllocation;
    a1.Ptr = (unsigned __int64)v24;
    LODWORD(a6) = 4200450;
    a1.Size = 24;
    EtwTraceSiloDcEvent(&a1, 1u, v5, v4, 635, a6);
  }
  return 0i64;
}

Referenced by: