VfAvlLookupTreeNode

_VF_AVL_TREE_NODE *__stdcall VfAvlLookupTreeNode(
        _VF_AVL_TREE *Tree,
        _VF_AVL_LOCK_CONTEXT *LockContext,
        VOID *p,
        UINT64 RangeSize){
  _VF_AVL_TREE_NODE *v4; 
  UINT64 NodeRangeSize; 
  char *v9; 
  unsigned __int64 v10; 
  char *v11; 
  unsigned __int64 i; 
  __int64 v13; 
  __int64 v14; 
  __int64 v15; 
  _VF_AVL_TABLE *v16; 
  unsigned __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  _VF_AVL_TABLE *Tables; 
  char *v22; 
  __int64 v23; 
  _VF_AVL_TREE_NODE_EX Node; 
  _TABLE_SEARCH_RESULT SearchResult; 
  VOID *NodeOrParent; 

  *(_QWORD *)&Node.SessionId = 0i64;
  v4 = 0i64;
  NodeRangeSize = RangeSize;
  if( !RangeSize )
    NodeRangeSize = Tree->NodeRangeSize;
  v9 = (char *)((unsigned __int64)p & 0xFFFFFFFFFFFFF000ui64);
  v10 = (NodeRangeSize + ((unsigned __int16)p & 0xFFF) + 4095i64) >> 12;
  if( (VOID *)((unsigned __int64)p & 0xFFFFFFFFFFFFF000ui64) == p )
    goto LABEL_4;
  Node.Base.p = p;
  v18 = NodeRangeSize;
  if( v10 > 1 )
    v18 = 4096i64;
  Node.Base.RangeSize = v18;
  ViAvlNodeInitializeSessionId(Tree, &Node);
  ViAvlTableIndex(Tree, Node.Base.p);
  v20 = v19;
  ViAvlRaiseIrqlSafe(LockContext);
  v23 = v20;
  ViAvlAcquireTableLockAtDpcLevelSafe(&Tree->Tables[v20], LockContext);
  Tables = Tree->Tables;
  NodeOrParent = 0i64;
  SearchResult = TableEmptyTree;
  v4 = (_VF_AVL_TREE_NODE *)RtlLookupElementGenericTableFullAvl(
                              &Tables[v20].RtlTable,
                              &Node,
                              &NodeOrParent,
                              &SearchResult);
  if( !v4 )
  {
    ViAvlReleaseTableLockFromDpcLevel(&Tree->Tables[v23], LockContext);
    --v10;
    v9 += 4096;
LABEL_4:
    v11 = (char *)p + NodeRangeSize;
    for( i = 0i64; i < v10; ++i )
    {
      Node.Base.p = v9;
      v22 = v9 + 4096;
      if( v9 + 4096 <= v11 )
        Node.Base.RangeSize = 4096i64;
      else
        Node.Base.RangeSize = v11 - v9;
      ViAvlNodeInitializeSessionId(Tree, &Node);
      ViAvlTableIndex(Tree, Node.Base.p);
      v14 = v13;
      ViAvlRaiseIrqlSafe(LockContext);
      v15 = v14;
      ViAvlAcquireTableLockAtDpcLevelSafe(&Tree->Tables[v14], LockContext);
      v16 = Tree->Tables;
      NodeOrParent = 0i64;
      SearchResult = TableEmptyTree;
      v4 = (_VF_AVL_TREE_NODE *)RtlLookupElementGenericTableFullAvl(
                                  &v16[v14].RtlTable,
                                  &Node,
                                  &NodeOrParent,
                                  &SearchResult);
      if( v4 )
        break;
      ViAvlReleaseTableLockFromDpcLevel(&Tree->Tables[v15], LockContext);
      v9 = v22;
    }
  }
  return v4;
}

Referenced by:

VerifierExDeleteResourceLite
VerifierExInitializeResourceLite
VerifierIoWMIRegistrationControl
VfCheckForLookaside
VfCheckForResource
VfDevObjIsDeviceRemoved
VfDevObjMarkDeviceRemoved
VfRemLockDeleteMemoryRange
VfTargetDriversEnableVerifier
VfTargetDriversGetNode
VfTargetDriversRemove
VfTargetEtwRegister
VfTargetEtwUnregister
ViDevObjRemove
ViLookasideAdd
ViLookasideDelete
ViRemLockDeleteFirstTreeNode
ViRemLockFindSurrogate
ViTargetAddToCounter
ViTargetFreeContiguousMemory
ViTargetIncrementCounter
ViTargetTrackContiguousMemory
ViTargetWMIDeregister
ViTargetWMIRegister