FsRtlFindInTunnelCacheEx

INT8 __fastcall FsRtlFindInTunnelCacheEx(
        _FAST_MUTEX *Mutex,
        UINT64 a2,
        _UNICODE_STRING *a3,
        _UNICODE_STRING *a4,
        _UNICODE_STRING *DestinationString,
        INT64 a6,
        INT64 a7,
        UINT8 *dst){
  TUNNEL *v10; 
  INT8 v11; 
  PRTL_SPLAY_LINKS v12; 
  PRTL_SPLAY_LINKS Cache; 
  NTSTATUS v14; 
  unsigned __int16 *p_RightChild; 
  VOID **PoolWithTag; 
  unsigned __int16 v17; 
  _LIST_ENTRY FreePoolList[3]; 

  v10 = (TUNNEL *)Mutex;
  v11 = 0;
  v12 = 0i64;
  if( !(_DWORD)TunnelMaxEntries )
    return 0;
  FreePoolList[0].Blink = FreePoolList;
  FreePoolList[0].Flink = FreePoolList;
  ExAcquireFastMutex(Mutex);
  FsRtlPruneTunnelCache(v10, FreePoolList);
  Cache = v10->Cache;
  if( Cache )
  {
    do
    {
      v12 = Cache;
      v14 = FsRtlCompareNodeAndKey((TUNNEL_NODE *)Cache, a2, a3);
      if( v14 > 0 )
      {
        Cache = Cache->LeftChild;
      }
      else
      {
        if( v14 >= 0 )
          break;
        Cache = Cache->RightChild;
      }
    }
    while( Cache );
    v10 = (TUNNEL *)Mutex;
  }
  if( Cache )
  {
    RtlCopyUnicodeString(a4, (PCUNICODE_STRING)&v12[3].LeftChild);
    p_RightChild = (unsigned __int16 *)&v12[2].RightChild;
    if( DestinationString->MaximumLength < LOWORD(v12[2].RightChild) )
    {
      PoolWithTag = ExAllocatePoolWithTag(0x11ui64, LOWORD(v12[2].RightChild), 879654228i64);
      DestinationString->Buffer = (wchar_t *)PoolWithTag;
      v17 = *p_RightChild;
      DestinationString->MaximumLength = *p_RightChild;
      DestinationString->Length = v17;
      memmove(PoolWithTag, v12[3].Parent, *p_RightChild);
    }
    else
    {
      RtlCopyUnicodeString(DestinationString, (PCUNICODE_STRING)&v12[2].RightChild);
    }
    memmove(dst, v12[4].Parent, (size_t)v12[4].LeftChild);
    *(_DWORD *)a7 = v12[4].LeftChild;
    v11 = 1;
  }
  KeReleaseGuardedMutex(&v10->Mutex);
  FsRtlEmptyFreePoolList(FreePoolList);
  return v11;
}

Referenced by: