MiRemoveUserPhysicalPagesView

RTL_BALANCED_NODE *__fastcall MiRemoveUserPhysicalPagesView(INT64 a1){
  _ETHREAD *CurrentThread; 
  __int64 v4; 
  UINT64 v5; 
  __int64 *v6; 
  RTL_BALANCED_NODE *v7; 
  unsigned __int64 *v8; 
  if( (*(_DWORD *)(a1 + 48) & 0x3100000) == 34603008 )
    return 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = *(_QWORD *)(*((_QWORD *)CurrentThread + 23) + 1680i64);
  MiLockAweVadsExclusive((INT64)CurrentThread);
  LODWORD(v6) = MiLocatePhysicalViewInTree(
                  (_WMI_LOGGER_CONTEXT *)(*(unsigned int *)(a1 + 24) | ((unsigned __int64)*(unsigned __int8 *)(a1 + 32) << 32)),
                  (_KPROFILE_SOURCE *)(v4 + 400),
                  v5);
  v7 = (RTL_BALANCED_NODE *)v6;
  RtlAvlRemoveNode(v8, v6);
  MiUnlockAweVadsExclusive((__int64)CurrentThread);
  v7->ParentValue = 0i64;
  return v7;
}

Referenced by: