MiFindUserSidHotPatchContext
_RTL_BALANCED_NODE *__fastcall MiFindUserSidHotPatchContext(UINT8 *a1){
_RTL_BALANCED_NODE *Root;
unsigned int v3;
__int64 v4;
int v5;
__int64 v7[3];
Root = MiUserSidPatchLists.Root;
if( !MiUserSidPatchLists.Root )
return 0i64;
v3 = RtlLengthSid((INT64)a1);
LODWORD(v4) = RtlHashBytes2(a1, v3);
v7[0] = v4;
v7[1] = (__int64)a1;
if( !Root )
return 0i64;
do
{
v5 = MiCompareUserSidHotPatchNodes(v7, (__int64)Root);
if( v5 >= 0 )
{
if( v5 <= 0 )
break;
Root = Root->Children[1];
}
else
{
Root = Root->Children[0];
}
}
while( Root );
if( Root )
return Root;
else
return 0i64;
}Referenced by:
MiFindProcessImageHotPatchRecord
MiQueryLoadedPatches
MiUnloadHotPatchForUserSid