VfAvlReserveNode
CHAR *__fastcall VfAvlReserveNode(INT64 a1, INT64 a2, INT64 a3){
unsigned int v3;
char *PoolWithTag;
CHAR *v8;
v3 = *(_DWORD *)(a1 + 32);
if( v3 == 1 )
LODWORD(PoolWithTag) = ExAllocateFromNPagedLookasideList((NPAGED_LOOKASIDE_LIST *)ViAvlNodeLookaside);
else
PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v3, 0x54416656ui64);
if( !PoolWithTag )
return 0i64;
v8 = PoolWithTag + 32;
*((_QWORD *)PoolWithTag + 4) = a2;
if( !a3 )
a3 = *(_QWORD *)a1;
*((_QWORD *)PoolWithTag + 5) = a3;
if( *(_BYTE *)(a1 + 28) )
ViAvlNodeInitializeSessionId(a1, (INT64)(PoolWithTag + 32));
return v8;
}Referenced by:
VerifierExInitializeResourceLite
VerifierIoInitializeRemoveLockEx
VfTargetDriversAdd
ViDevObjAdd
ViLookasideAdd