VmpFaultEntryRemove
INT64 __fastcall VmpFaultEntryRemove(INT64 a1, UINT64 a2, UINT64 a3){
unsigned __int64 v3;
UINT64 v5;
unsigned __int8 CurrentIrql;
INT64 result;
v3 = a2;
v5 = a2 + 48i64 * (unsigned int)a3;
CurrentIrql = KeGetCurrentIrql();
__writecr8(0xFui64);
ExAcquireSpinLockExclusiveAtDpcLevel((INT64 *)(a1 + 64));
while( v3 < v5 )
{
RtlRbRemoveNode((unsigned __int64 *)(a1 + 48), v3);
v3 += 48i64;
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a1 + 64));
result = CurrentIrql;
__writecr8(CurrentIrql);
return result;
}Referenced by:
VmpAccessFaultBatch