PiLookupInDDB

INT64 __stdcall PiLookupInDDB(_UNICODE_STRING *FullPath, PVOID ImageBase, UINT64 ImageSize, _GUID *EntryGuid){
  PVOID v4; 
  PVOID v6; 
  unsigned int v8; 
  int IsDriverBlocked; 
  INT64 v12[2]; 
  __int128 v13; 
  INT64 v14[2]; 
  __int128 v15; 
  v4 = PpDDBPatchHandle;
  v6 = PpDDBHandle;
  v8 = ImageSize;
  *(_OWORD *)v12 = 0i64;
  v13 = 0i64;
  *(_OWORD *)v14 = 0i64;
  v15 = 0i64;
  if( !PpDDBHandle )
  {
    IsDriverBlocked = PiInitializeDDB(L"\\SystemRoot\\AppPatch\\drvmain.sdb");
    if( IsDriverBlocked < 0 )
      goto LABEL_6;
    v6 = (PVOID)v12[0];
  }
  IsDriverBlocked = PiIsDriverBlocked(v6, FullPath, ImageBase, v8, EntryGuid);
  if( IsDriverBlocked < 0 )
    goto LABEL_6;
  if( !PpDDBHandle )
  {
    IsDriverBlocked = PiInitializeDDB(L"\\SystemRoot\\AppPatch\\drvpatch.sdb");
    if( IsDriverBlocked < 0 )
    {
      IsDriverBlocked = 0;
      goto LABEL_6;
    }
    v4 = (PVOID)v14[0];
  }
  if( v4 )
    IsDriverBlocked = PiIsDriverBlocked(v4, FullPath, ImageBase, v8, EntryGuid);
LABEL_6:
  if( v12[0] )
    PiReleaseDDB((INT64)v12);
  if( v14[0] )
    PiReleaseDDB((INT64)v14);
  return(unsigned int)IsDriverBlocked;
}

Referenced by:

PpCheckInDriverDatabase