MiFindEmptyAddressRangeDown

NTSTATUS __stdcall MiFindEmptyAddressRangeDown(
        _RTL_AVL_TREE *Root,
        UINT64 SizeOfRange,
        UINT64 Alignment,
        PVOID HighestAddressToEndAt,
        UINT64 ProtectionMask,
        PVOID *Base){
  _RTL_BALANCED_NODE *v10; 
  PVOID *Children; 
  _RTL_BALANCED_NODE *v12; 
  _EPROCESS *Process; 
  int v14; 
  __int64 v15; 
  NTSTATUS EmptyAddressRangeDownTree; 
  NTSTATUS v17; 
  UINT64 v19; 
  __int64 v20; 
  PVOID *Basea; 
  char v22; 

  if( (unsigned __int64)Base - ProtectionMask + 1 < SizeOfRange )
    return -1073741801;
  v10 = (_RTL_BALANCED_NODE *)((char *)Base + 1);
  Children = (PVOID *)Root[7].Root->Children;
  v12 = (_RTL_BALANCED_NODE *)((char *)Base + 1);
  Process = KeGetCurrentThread()->ApcState.Process;
  Basea = (PVOID *)Process;
  if( (_RTL_BALANCED_NODE *)((unsigned __int64)Base + 1) > Root[6].Root )
    v12 = Root[6].Root;
  v14 = (int)Root[8].Root;
  v15 = (unsigned __int8)v14;
  if( !(_BYTE)v14 )
    v15 = 1i64;
  v20 = v15;
  if( (unsigned __int64)Children < ProtectionMask )
    Children = (PVOID *)ProtectionMask;
  while( 1 )
  {
    if( Children >= Base || (char *)Base - (char *)Children + 1 < SizeOfRange )
    {
      v17 = -1073741801;
    }
    else
    {
      EmptyAddressRangeDownTree = MiFindEmptyAddressRangeDownTree(
                                    &Process->VadRoot,
                                    SizeOfRange,
                                    Alignment,
                                    HighestAddressToEndAt,
                                    Children,
                                    (VOID **)v12->Children);
      v15 = v20;
      v17 = EmptyAddressRangeDownTree;
    }
    if( v17 >= 0 )
      break;
    if( v12 == v10 || (v22 & 2) != 0 )
    {
      v19 = v15 << 16;
      if( (v22 & 2) == 0 )
        v19 = 0x10000i64;
      if( v19 < ProtectionMask )
        v19 = ProtectionMask;
      if( v19 >= (unsigned __int64)Children )
        return v17;
      Process = (_EPROCESS *)Basea;
      Children = (PVOID *)v19;
    }
    else
    {
      Process = (_EPROCESS *)Basea;
      v12 = (_RTL_BALANCED_NODE *)((char *)Base + 1);
    }
  }
  return v17;
}

Referenced by: