RtlFindUnicodeSubstring
CHAR *__stdcall RtlFindUnicodeSubstring(UINT16 *a1, UINT16 *a2, CHAR a3){
__int64 v3;
char *v4;
UINT64 v5;
char *v6;
UINT16 *v7;
UINT16 *v8;
char *i;
UINT16 *j;
UINT16 v11;
UINT16 v12;
__int16 v13;
void *v15;
v3 = *a2;
if( *a1 < (unsigned __int16)v3 )
return 0i64;
v4 = (char *)*((_QWORD *)a1 + 1);
v5 = *a2;
v6 = &v4[*a1 - v3];
if( !a3 )
{
if( v4 <= v6 )
{
v15 = (void *)*((_QWORD *)a2 + 1);
while( memcmp(v4, v15, v5) )
{
v4 += 2;
if( v4 > v6 )
return 0i64;
}
return v4;
}
return 0i64;
}
v7 = (UINT16 *)*((_QWORD *)a2 + 1);
v8 = (UINT16 *)((char *)v7 + *a2);
if( v4 > v6 )
return 0i64;
for( i = (char *)(v4 - (char *)v7); ; i += 2 )
{
for( j = v7; j < v8; ++j )
{
v11 = *(UINT16 *)((char *)j + (_QWORD)i);
if( v11 != *j )
{
NLS_UPCASE(*j);
v12 = NLS_UPCASE(v11);
if( v12 != v13 )
break;
}
}
if( j == v8 )
break;
v4 += 2;
if( v4 > v6 )
return 0i64;
}
return v4;
}Referenced by:
CmpTraceSecurityChanging
PiDrvDbFindSystemFilePathToken
PiDrvDbRegisterNode