MiLocateAddress

RTL_BALANCED_NODE *__fastcall MiLocateAddress(UINT64 a1){
  __int64 v1; 
  RTL_BALANCED_NODE *result; 
  unsigned __int64 v3; 
  RTL_BALANCED_NODE *v4; 
  v1 = *((_QWORD *)KeGetCurrentThread() + 23);
  result = *(RTL_BALANCED_NODE **)(v1 + 2016);
  if( !result )
    return 0i64;
  v3 = a1 >> 12;
  if( a1 >> 12 < (LODWORD(result[1].Children[0]) | ((unsigned __int64)LOBYTE(result[1].Right) << 32))
    || v3 > (HIDWORD(result[1].Left) | ((unsigned __int64)BYTE1(result[1].Right) << 32)) )
  {
    v4 = *(RTL_BALANCED_NODE **)(v1 + 2008);
    if( v4 )
    {
      while( 1 )
      {
        if( v3 > (HIDWORD(v4[1].Left) | ((unsigned __int64)BYTE1(v4[1].Right) << 32)) )
        {
          v4 = v4->Children[1];
        }
        else
        {
          if( v3 >= (LODWORD(v4[1].Children[0]) | ((unsigned __int64)LOBYTE(v4[1].Right) << 32)) )
          {
            *(_QWORD *)(v1 + 2016) = v4;
            return v4;
          }
          v4 = v4->Children[0];
        }
        if( !v4 )
          return 0i64;
      }
    }
    return 0i64;
  }
  return result;
}

Referenced by: