VfAvlLookupTreeNode
CHAR *__fastcall VfAvlLookupTreeNode(INT64 *a1, INT64 a2, UINT64 a3, INT64 a4){
CHAR *v4;
INT64 v5;
UINT64 v9;
UINT64 v10;
unsigned __int64 v11;
UINT64 i;
UINT64 v13;
__int64 v14;
INT64 v15;
CHAR *v16;
__int64 v18;
UINT64 v19;
INT64 v20;
CHAR *v21;
UINT64 v22;
__int64 v23;
UINT64 Buffer;
__int64 v25;
__int64 v26;
TABLE_SEARCH_RESULT SearchResult;
PVOID NodeOrParent;
v26 = 0i64;
v4 = 0i64;
v5 = a4;
if( !a4 )
v5 = *a1;
v9 = a3 & 0xFFFFFFFFFFFFF000ui64;
v10 = (v5 + (a3 & 0xFFF) + 4095) >> 12;
if( (a3 & 0xFFFFFFFFFFFFF000ui64) == a3 )
goto LABEL_4;
Buffer = a3;
v18 = v5;
if( v10 > 1 )
v18 = 4096i64;
v25 = v18;
ViAvlNodeInitializeSessionId((INT64)a1, (INT64)&Buffer);
v19 = ViAvlTableIndex((INT64)a1, Buffer);
ViAvlRaiseIrqlSafe(a2);
v23 = 192 * v19;
ViAvlAcquireTableLockAtDpcLevelSafe(192 * v19 + a1[2], a2);
v20 = a1[2];
NodeOrParent = 0i64;
SearchResult = TableEmptyTree;
LODWORD(v21) = RtlLookupElementGenericTableFullAvl(
(RTL_AVL_TABLE *)(192 * v19 + v20),
&Buffer,
&NodeOrParent,
&SearchResult);
v4 = v21;
if( !v21 )
{
ViAvlReleaseTableLockFromDpcLevel(v23 + a1[2], a2);
--v10;
v9 += 4096i64;
LABEL_4:
v11 = v5 + a3;
for( i = 0i64; i < v10; ++i )
{
Buffer = v9;
v22 = v9 + 4096;
if( v9 + 4096 <= v11 )
v25 = 4096i64;
else
v25 = v11 - v9;
ViAvlNodeInitializeSessionId((INT64)a1, (INT64)&Buffer);
v13 = ViAvlTableIndex((INT64)a1, Buffer);
ViAvlRaiseIrqlSafe(a2);
v14 = 192 * v13;
ViAvlAcquireTableLockAtDpcLevelSafe(192 * v13 + a1[2], a2);
v15 = a1[2];
NodeOrParent = 0i64;
SearchResult = TableEmptyTree;
LODWORD(v16) = RtlLookupElementGenericTableFullAvl(
(RTL_AVL_TABLE *)(192 * v13 + v15),
&Buffer,
&NodeOrParent,
&SearchResult);
v4 = v16;
if( v16 )
break;
ViAvlReleaseTableLockFromDpcLevel(v14 + a1[2], a2);
v9 = v22;
}
}
return v4;
}Referenced by:
VerifierExDeleteResourceLite
VerifierExInitializeResourceLite
VerifierIoWMIRegistrationControl
VfCheckForLookaside
VfCheckForResource
VfDevObjIsDeviceRemoved
VfDevObjMarkDeviceRemoved
VfRemLockDeleteMemoryRange
VfTargetDriversEnableVerifier
VfTargetDriversGetNode
VfTargetDriversRemove
VfTargetEtwRegister
VfTargetEtwUnregister
ViDevObjRemove
ViLookasideAdd
ViLookasideDelete
ViRemLockDeleteFirstTreeNode
ViRemLockFindSurrogate
ViTargetAddToCounter
ViTargetFreeContiguousMemory
ViTargetIncrementCounter
ViTargetTrackContiguousMemory
ViTargetWMIDeregister
ViTargetWMIRegister