PiLookupInDDB
INT64 __stdcall PiLookupInDDB(_UNICODE_STRING *FullPath, PVOID ImageBase, UINT64 ImageSize, _GUID *EntryGuid){
PVOID v4;
PVOID v6;
unsigned int v8;
int IsDriverBlocked;
INT64 v12[2];
__int128 v13;
INT64 v14[2];
__int128 v15;
v4 = PpDDBPatchHandle;
v6 = PpDDBHandle;
v8 = ImageSize;
*(_OWORD *)v12 = 0i64;
v13 = 0i64;
*(_OWORD *)v14 = 0i64;
v15 = 0i64;
if( !PpDDBHandle )
{
IsDriverBlocked = PiInitializeDDB(L"\\SystemRoot\\AppPatch\\drvmain.sdb");
if( IsDriverBlocked < 0 )
goto LABEL_6;
v6 = (PVOID)v12[0];
}
IsDriverBlocked = PiIsDriverBlocked(v6, FullPath, ImageBase, v8, EntryGuid);
if( IsDriverBlocked < 0 )
goto LABEL_6;
if( !PpDDBHandle )
{
IsDriverBlocked = PiInitializeDDB(L"\\SystemRoot\\AppPatch\\drvpatch.sdb");
if( IsDriverBlocked < 0 )
{
IsDriverBlocked = 0;
goto LABEL_6;
}
v4 = (PVOID)v14[0];
}
if( v4 )
IsDriverBlocked = PiIsDriverBlocked(v4, FullPath, ImageBase, v8, EntryGuid);
LABEL_6:
if( v12[0] )
PiReleaseDDB((INT64)v12);
if( v14[0] )
PiReleaseDDB((INT64)v14);
return(unsigned int)IsDriverBlocked;
}Referenced by:
PpCheckInDriverDatabase