VmpFaultEntryRemove

INT64 __fastcall VmpFaultEntryRemove(INT64 a1, UINT64 a2, UINT64 a3){
  unsigned __int64 v3; 
  UINT64 v5; 
  unsigned __int8 CurrentIrql; 
  INT64 result; 
  v3 = a2;
  v5 = a2 + 48i64 * (unsigned int)a3;
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(0xFui64);
  ExAcquireSpinLockExclusiveAtDpcLevel((INT64 *)(a1 + 64));
  while( v3 < v5 )
  {
    RtlRbRemoveNode((unsigned __int64 *)(a1 + 48), v3);
    v3 += 48i64;
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a1 + 64));
  result = CurrentIrql;
  __writecr8(CurrentIrql);
  return result;
}

Referenced by:

VmpAccessFaultBatch