MiLocatePhysicalViewInTree

NTSTATUS __stdcall MiLocatePhysicalViewInTree(
        _WMI_LOGGER_CONTEXT *LoggerContext,
        _KPROFILE_SOURCE *CounterList,
        UINT64 a3){
  _QWORD *v3; 
  __int64 v4; 
  v3 = *(_QWORD **)CounterList;
  while( v3 )
  {
    v4 = v3[3];
    if( (unsigned __int64)LoggerContext > (*(unsigned int *)(v4 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v4 + 33) << 32)) )
    {
      v3 = (_QWORD *)v3[1];
    }
    else
    {
      if( (unsigned __int64)LoggerContext >= (*(unsigned int *)(v4 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v4 + 32) << 32)) )
        return(int)v3;
      v3 = (_QWORD *)*v3;
    }
  }
  return(int)v3;
}

Referenced by:

MiRemoveUserPhysicalPagesView