KsepGetModuleInfoByName

NTSTATUS __stdcall KsepGetModuleInfoByName(WCHAR *ModuleName, _RTL_PROCESS_MODULES *LoadedModules, VOID **BaseAddress){
  int v5; 
  int v6; 
  _RTL_PROCESS_MODULES *v7; 
  _STRING DestinationString; 
  _UNICODE_STRING SourceString; 
  _STRING String1; 

  DestinationString = 0i64;
  String1 = 0i64;
  SourceString = 0i64;
  if( !ModuleName || !BaseAddress || !LoadedModules )
    return -1073741811;
  RtlInitUnicodeString(&SourceString, ModuleName);
  v5 = RtlUnicodeStringToAnsiString(&DestinationString, &SourceString, 1u);
  if( v5 >= 0 )
  {
    v6 = 0;
    if( *LoadedModules )
    {
      while( 1 )
      {
        v7 = &LoadedModules[74 * v6 + 2];
        RtlInitAnsiString(&String1, (PCSZ)v7 + *((unsigned __int16 *)v7 + 19) + 40);
        if( !RtlCompareString(&String1, &DestinationString, 1u) )
          break;
        if( ++v6 >= (unsigned int)*LoadedModules )
          goto LABEL_8;
      }
      v5 = 0;
      *BaseAddress = (VOID *)*((_QWORD *)v7 + 2);
    }
    else
    {
LABEL_8:
      v5 = -1073741275;
    }
  }
  if( DestinationString.Buffer )
    RtlFreeAnsiString((_UNICODE_STRING *)&DestinationString);
  return v5;
}

Referenced by: