VfAvlLookupTreeNode

CHAR *__fastcall VfAvlLookupTreeNode(INT64 *a1, INT64 a2, UINT64 a3, INT64 a4){
  CHAR *v4; 
  INT64 v5; 
  UINT64 v9; 
  UINT64 v10; 
  unsigned __int64 v11; 
  UINT64 i; 
  UINT64 v13; 
  __int64 v14; 
  INT64 v15; 
  CHAR *v16; 
  __int64 v18; 
  UINT64 v19; 
  INT64 v20; 
  CHAR *v21; 
  UINT64 v22; 
  __int64 v23; 
  UINT64 Buffer; 
  __int64 v25; 
  __int64 v26; 
  TABLE_SEARCH_RESULT SearchResult; 
  PVOID NodeOrParent; 
  v26 = 0i64;
  v4 = 0i64;
  v5 = a4;
  if( !a4 )
    v5 = *a1;
  v9 = a3 & 0xFFFFFFFFFFFFF000ui64;
  v10 = (v5 + (a3 & 0xFFF) + 4095) >> 12;
  if( (a3 & 0xFFFFFFFFFFFFF000ui64) == a3 )
    goto LABEL_4;
  Buffer = a3;
  v18 = v5;
  if( v10 > 1 )
    v18 = 4096i64;
  v25 = v18;
  ViAvlNodeInitializeSessionId((INT64)a1, (INT64)&Buffer);
  v19 = ViAvlTableIndex((INT64)a1, Buffer);
  ViAvlRaiseIrqlSafe(a2);
  v23 = 192 * v19;
  ViAvlAcquireTableLockAtDpcLevelSafe(192 * v19 + a1[2], a2);
  v20 = a1[2];
  NodeOrParent = 0i64;
  SearchResult = TableEmptyTree;
  LODWORD(v21) = RtlLookupElementGenericTableFullAvl(
                   (RTL_AVL_TABLE *)(192 * v19 + v20),
                   &Buffer,
                   &NodeOrParent,
                   &SearchResult);
  v4 = v21;
  if( !v21 )
  {
    ViAvlReleaseTableLockFromDpcLevel(v23 + a1[2], a2);
    --v10;
    v9 += 4096i64;
LABEL_4:
    v11 = v5 + a3;
    for( i = 0i64; i < v10; ++i )
    {
      Buffer = v9;
      v22 = v9 + 4096;
      if( v9 + 4096 <= v11 )
        v25 = 4096i64;
      else
        v25 = v11 - v9;
      ViAvlNodeInitializeSessionId((INT64)a1, (INT64)&Buffer);
      v13 = ViAvlTableIndex((INT64)a1, Buffer);
      ViAvlRaiseIrqlSafe(a2);
      v14 = 192 * v13;
      ViAvlAcquireTableLockAtDpcLevelSafe(192 * v13 + a1[2], a2);
      v15 = a1[2];
      NodeOrParent = 0i64;
      SearchResult = TableEmptyTree;
      LODWORD(v16) = RtlLookupElementGenericTableFullAvl(
                       (RTL_AVL_TABLE *)(192 * v13 + v15),
                       &Buffer,
                       &NodeOrParent,
                       &SearchResult);
      v4 = v16;
      if( v16 )
        break;
      ViAvlReleaseTableLockFromDpcLevel(v14 + a1[2], a2);
      v9 = v22;
    }
  }
  return v4;
}

Referenced by:

VerifierExDeleteResourceLite
VerifierExInitializeResourceLite
VerifierIoWMIRegistrationControl
VfCheckForLookaside
VfCheckForResource
VfDevObjIsDeviceRemoved
VfDevObjMarkDeviceRemoved
VfRemLockDeleteMemoryRange
VfTargetDriversEnableVerifier
VfTargetDriversGetNode
VfTargetDriversRemove
VfTargetEtwRegister
VfTargetEtwUnregister
ViDevObjRemove
ViLookasideAdd
ViLookasideDelete
ViRemLockDeleteFirstTreeNode
ViRemLockFindSurrogate
ViTargetAddToCounter
ViTargetFreeContiguousMemory
ViTargetIncrementCounter
ViTargetTrackContiguousMemory
ViTargetWMIDeregister
ViTargetWMIRegister