RtlAvlRemoveNode

INT8 __fastcall RtlAvlRemoveNode(UINT64 *a1, INT64 *a2){
  INT64 v2; 
  INT64 v4; 
  INT64 v5; 
  INT64 v7; 
  unsigned __int64 v8; 
  char v9; 
  __int8 v10; 
  $2AC33BEB5BE0E2B4BDE1FE63E3EEE4EC *v11; 
  unsigned __int8 v12; 
  unsigned __int64 ParentValue; 
  unsigned __int64 v14; 
  bool v15; 
  _QWORD *v16; 
  INT64 v17; 
  unsigned int v18; 
  _RTL_BALANCED_NODE *v19; 
  __int64 v20; 
  __int64 v21; 
  unsigned __int64 v22; 
  _RTL_BALANCED_NODE *v23; 
  char v24; 
  __int64 v25; 
  _RTL_BALANCED_NODE **v26; 
  unsigned __int64 v27; 
  _RTL_BALANCED_NODE *v28; 
  __int64 v29; 
  INT64 v30; 
  __int8 v31; 
  unsigned __int8 v32; 
  unsigned __int64 v33; 

  v2 = *a2;
  v4 = a2[1];
  v5 = v4;
  if( *a2 )
    v5 = *a2;
  v7 = 0i64;
  if( v2 )
    v7 = a2[1];
  if( !v7 )
  {
    v8 = a2[2] & 0xFFFFFFFFFFFFFFFCui64;
    if( v5 )
    {
      if( *(INT64 **)(v5 + 16) != a2 )
        goto LABEL_77;
      *(_QWORD *)(v5 + 16) = v8;
    }
    if( v8 )
    {
      if( *(INT64 **)(v8 + 8) == a2 )
      {
        v9 = 3;
        *(_QWORD *)(v8 + 8) = v5;
        goto LABEL_14;
      }
      if( *(INT64 **)v8 == a2 )
      {
        v9 = 1;
        *(_QWORD *)v8 = v5;
        goto LABEL_14;
      }
    }
    else if( (INT64 *)*a1 == a2 )
    {
      *a1 = v5;
      return v7;
    }
LABEL_77:
    __fastfail(0x1Du);
  }
  if( (a2[2] & 3) == 3 )
  {
    v30 = *(_QWORD *)(v2 + 8);
    v18 = 0;
    v17 = *a2;
    v8 = *a2;
    if( v30 )
    {
      v18 = 1;
      do
      {
        v8 = v17;
        v17 = v30;
        v30 = *(_QWORD *)(v30 + 8);
      }
      while( v30 );
    }
    v19 = *(_RTL_BALANCED_NODE **)v17;
  }
  else
  {
    v16 = *(_QWORD **)v4;
    v17 = a2[1];
    v8 = v17;
    v18 = 1;
    if( *(_QWORD *)v4 )
    {
      v18 = 0;
      do
      {
        v8 = v17;
        v17 = (INT64)v16;
        v16 = (_QWORD *)*v16;
      }
      while( v16 );
    }
    v19 = *(_RTL_BALANCED_NODE **)(v17 + 8);
  }
  *(_QWORD *)v17 = v2;
  *(_QWORD *)(v17 + 8) = v4;
  v20 = *(_QWORD *)(v2 + 16);
  if( (INT64 *)(v20 & 0xFFFFFFFFFFFFFFFCui64) != a2 )
    goto LABEL_77;
  *(_QWORD *)(v2 + 16) = v17 | v20 & 3;
  v21 = *(_QWORD *)(v4 + 16);
  if( (INT64 *)(v21 & 0xFFFFFFFFFFFFFFFCui64) != a2 )
    goto LABEL_77;
  *(_QWORD *)(v4 + 16) = v17 | v21 & 3;
  if( (*(_QWORD *)(v17 + 16) & 0xFFFFFFFFFFFFFFFCui64) != v8 )
    goto LABEL_77;
  *(_QWORD *)(v8 + 8i64 * v18) = v19;
  if( v19 )
  {
    if( v19->ParentValue != v17 )
      goto LABEL_77;
    v19->ParentValue = v8;
  }
  *(_QWORD *)(v17 + 16) = a2[2];
  v9 = 3;
  if( !v18 )
    v9 = 1;
  v22 = a2[2] & 0xFFFFFFFFFFFFFFFCui64;
  if( !v22 )
  {
    if( (INT64 *)*a1 == a2 )
    {
      *a1 = v17;
      goto LABEL_14;
    }
    goto LABEL_77;
  }
  v29 = 0i64;
  if( *(INT64 **)(v22 + 8) == a2 )
    v29 = 8i64;
  if( *(INT64 **)(v29 + v22) != a2 )
    goto LABEL_77;
  *(_QWORD *)(v29 + v22) = v17;
  while( 1 )
  {
LABEL_14:
    v10 = *(_BYTE *)(v8 + 16);
    v11 = ($2AC33BEB5BE0E2B4BDE1FE63E3EEE4EC *)(v8 + 16);
    v12 = v10 & 3;
    if( (v10 & 3) == ((unsigned __int8)v9 ^ 2) )
    {
      LOBYTE(v7) = v10 & 0xFC;
      v11->_bf_0 = v7;
      ParentValue = v11->ParentValue;
      goto LABEL_20;
    }
    if( !v12 )
    {
      LOBYTE(v7) = v9 | v10 & 0xFC;
      *(_BYTE *)(v8 + 16) = v7;
      return v7;
    }
    ParentValue = v11->ParentValue;
    v23 = *(_RTL_BALANCED_NODE **)v8;
    if( v9 == 1 )
      v23 = *(_RTL_BALANCED_NODE **)(v8 + 8);
    v24 = v23->_bf_0 & 3;
    if( v24 != ((unsigned __int8)v9 ^ 2) )
      break;
    v7 = (INT64)RtlpTreeDoubleRotateNodes((_RTL_BALANCED_NODE **)a1, (_RTL_BALANCED_NODE *)v8, v23, v9 == 1);
    v11->_bf_0 &= 0xFCu;
    v8 = v7;
    v31 = v23->_bf_0 & 0xFC;
    v23->_bf_0 = v31;
    v32 = *(_BYTE *)(v7 + 16);
    LODWORD(v7) = v32 & 3;
    if( v12 == (_DWORD)v7 )
    {
      LOBYTE(v7) = (v12 ^ v11->_bf_0 ^ 0xFE) & 3;
      v11->_bf_0 ^= v7;
      *(_BYTE *)(v8 + 16) &= 0xFCu;
    }
    else
    {
      if( v12 == ((v32 ^ 0xFE) & 3) )
        v23->_bf_0 = v12 | v31;
      *(_BYTE *)(v8 + 16) &= 0xFCu;
    }
LABEL_20:
    v14 = ParentValue & 0xFFFFFFFFFFFFFFFCui64;
    if( !v14 )
      return v7;
    v15 = *(_QWORD *)(v14 + 8) == v8;
    v9 = 3;
    v8 = v14;
    if( !v15 )
      v9 = 1;
  }
  if( (v23->ParentValue & 0xFFFFFFFFFFFFFFFCui64) != v8 )
    goto LABEL_77;
  v25 = 0i64;
  if( v9 == 1 )
    v25 = 8i64;
  v26 = (_RTL_BALANCED_NODE **)(v25 + v8);
  if( *(_RTL_BALANCED_NODE **)(v25 + v8) != v23 )
    goto LABEL_77;
  v27 = ParentValue & 0xFFFFFFFFFFFFFFFCui64;
  if( (ParentValue & 0xFFFFFFFFFFFFFFFCui64) != 0 )
  {
    if( *(_QWORD *)(v27 + 8) == v8 )
    {
      *(_QWORD *)(v27 + 8) = v23;
    }
    else
    {
      if( *(_QWORD *)v27 != v8 )
        goto LABEL_77;
      *(_QWORD *)v27 = v23;
    }
  }
  else
  {
    if( *a1 != v8 )
      goto LABEL_77;
    *a1 = (UINT64)v23;
  }
  v23->ParentValue = v27 | *(_DWORD *)&v23->_bf_0 & 3;
  v7 = 0i64;
  if( v9 != 1 )
    v7 = 8i64;
  v28 = *(_RTL_BALANCED_NODE **)((char *)v23->Children + v7);
  if( v28 )
  {
    v33 = v28->ParentValue;
    if( (_RTL_BALANCED_NODE *)(v33 & 0xFFFFFFFFFFFFFFFCui64) != v23 )
      goto LABEL_77;
    v28->ParentValue = v8 | v33 & 3;
  }
  *v26 = v28;
  *(_RTL_BALANCED_NODE **)((char *)v23->Children + v7) = (_RTL_BALANCED_NODE *)v8;
  v11->ParentValue = (unsigned __int64)v23 | *(_DWORD *)&v11->_bf_0 & 3;
  LOBYTE(v7) = v23->_bf_0 & 0xFC;
  if( v24 )
  {
    v23->_bf_0 = v7;
    v8 = (unsigned __int64)v23;
    v11->_bf_0 &= 0xFCu;
    goto LABEL_20;
  }
  v23->_bf_0 = v7 | (v9 ^ 0xFE) & 3;
  return v7;
}

Referenced by:

ExpWnfDeleteNameInstance
MiActOnPartitionNodePages
MiAllocateEntireImageFileExtents
MiClearRangeInPartitionTree
MiCloneVads
MiCombiningInProgress
MiDeleteDeferredCloneDescriptors
MiDeleteHotPatchRecord
MiDeleteImageExtentList
MiDeleteKernelStackNode
MiDeletePartitionResources
MiDeleteStaleCacheMaps
MiDeleteVad
MiFreeCombineBlock
MiFreeMdlTracker
MiFreePartitionTree
MiHotAddPartitionMemory
MiHotRemoveHugeRange
MiInitializeDriverPtes
MiInsertHotPatchRecord
MiInsertPartitionPages
MiInsertSecureImageActivePatch
MiMakeEntireHugePfnGood
MiMakeIoRangePermanent
MiMarkHugePfnGood
MiProcessCrcList
MiProcessLoaderEntry
MiReleasePartitionHugeIoSpace
MiRemoveFaultNode
MiRemoveFromSystemSpace
MiRemoveMappingNode
MiRemoveUnmappedIoNode
MiRemoveUserPhysicalPagesView
MiRemoveVad
MiReplaceSystemProtoPtesNode
MiSectionDelete
MiSessionRemoveImage
MiUnlinkSessionList
MiUnloadHotPatch
MiUnloadHotPatchForUserSid
MiUpdatePageFileList
MiUpdatePerSessionProto
MiUpdateSystemProtoPtesTree
MiWaitForInPageComplete
MiZeroPage
MmManageFaultRange
MmUpdateMdlTrackerForMdlSwitch
PsAdjustBasicEnclaveThreadList
PsCallEnclave
PspProcessDynamicEHContinuationTargets
RtlRemoveDynamicEnforcedAddressRange