RtlFindUnicodeSubstring

CHAR *__stdcall RtlFindUnicodeSubstring(UINT16 *a1, UINT16 *a2, CHAR a3){
  __int64 v3; 
  char *v4; 
  UINT64 v5; 
  char *v6; 
  UINT16 *v7; 
  UINT16 *v8; 
  char *i; 
  UINT16 *j; 
  UINT16 v11; 
  UINT16 v12; 
  __int16 v13; 
  void *v15; 
  v3 = *a2;
  if( *a1 < (unsigned __int16)v3 )
    return 0i64;
  v4 = (char *)*((_QWORD *)a1 + 1);
  v5 = *a2;
  v6 = &v4[*a1 - v3];
  if( !a3 )
  {
    if( v4 <= v6 )
    {
      v15 = (void *)*((_QWORD *)a2 + 1);
      while( memcmp(v4, v15, v5) )
      {
        v4 += 2;
        if( v4 > v6 )
          return 0i64;
      }
      return v4;
    }
    return 0i64;
  }
  v7 = (UINT16 *)*((_QWORD *)a2 + 1);
  v8 = (UINT16 *)((char *)v7 + *a2);
  if( v4 > v6 )
    return 0i64;
  for( i = (char *)(v4 - (char *)v7); ; i += 2 )
  {
    for( j = v7; j < v8; ++j )
    {
      v11 = *(UINT16 *)((char *)j + (_QWORD)i);
      if( v11 != *j )
      {
        NLS_UPCASE(*j);
        v12 = NLS_UPCASE(v11);
        if( v12 != v13 )
          break;
      }
    }
    if( j == v8 )
      break;
    v4 += 2;
    if( v4 > v6 )
      return 0i64;
  }
  return v4;
}

Referenced by:

CmpTraceSecurityChanging
PiDrvDbFindSystemFilePathToken
PiDrvDbRegisterNode