VfAvlReserveNode

CHAR *__fastcall VfAvlReserveNode(INT64 a1, INT64 a2, INT64 a3){
  unsigned int v3; 
  char *PoolWithTag; 
  CHAR *v8; 
  v3 = *(_DWORD *)(a1 + 32);
  if( v3 == 1 )
    LODWORD(PoolWithTag) = ExAllocateFromNPagedLookasideList((NPAGED_LOOKASIDE_LIST *)ViAvlNodeLookaside);
  else
    PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v3, 0x54416656ui64);
  if( !PoolWithTag )
    return 0i64;
  v8 = PoolWithTag + 32;
  *((_QWORD *)PoolWithTag + 4) = a2;
  if( !a3 )
    a3 = *(_QWORD *)a1;
  *((_QWORD *)PoolWithTag + 5) = a3;
  if( *(_BYTE *)(a1 + 28) )
    ViAvlNodeInitializeSessionId(a1, (INT64)(PoolWithTag + 32));
  return v8;
}

Referenced by:

VerifierExInitializeResourceLite
VerifierIoInitializeRemoveLockEx
VfTargetDriversAdd
ViDevObjAdd
ViLookasideAdd