MiLocatePhysicalViewInTree
NTSTATUS __stdcall MiLocatePhysicalViewInTree(
_WMI_LOGGER_CONTEXT *LoggerContext,
_KPROFILE_SOURCE *CounterList,
UINT64 a3){
_QWORD *v3;
__int64 v4;
v3 = *(_QWORD **)CounterList;
while( v3 )
{
v4 = v3[3];
if( (unsigned __int64)LoggerContext > (*(unsigned int *)(v4 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v4 + 33) << 32)) )
{
v3 = (_QWORD *)v3[1];
}
else
{
if( (unsigned __int64)LoggerContext >= (*(unsigned int *)(v4 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v4 + 32) << 32)) )
return(int)v3;
v3 = (_QWORD *)*v3;
}
}
return(int)v3;
}Referenced by:
MiRemoveUserPhysicalPagesView