RtlPrefixUnicodeString

NTSTATUS __stdcall RtlPrefixUnicodeString(PVOID EventHandle, INT64 *PreviousState){
  char v2; 
  __int64 v3; 
  _WORD *v4; 
  char *v5; 
  INT64 v6; 
  UINT16 v7; 
  UINT16 v8; 
  __int16 v9; 
  INT64 v10; 
  v3 = *(unsigned __int16 *)EventHandle;
  v4 = (_WORD *)*((_QWORD *)EventHandle + 1);
  if( *(_WORD *)PreviousState < (unsigned __int16)v3 )
  {
LABEL_9:
    LOBYTE(v3) = 0;
    return v3;
  }
  v5 = (char *)v4 + v3;
  if( v4 < (_WORD *)((char *)v4 + v3) )
  {
    if( v2 )
    {
      v6 = PreviousState[1] - (_QWORD)v4;
      while( 1 )
      {
        v7 = *(_WORD *)((char *)v4 + v6);
        if( *v4 != v7 )
        {
          NLS_UPCASE(v7);
          LOWORD(v3) = NLS_UPCASE(v8);
          if( (_WORD)v3 != v9 )
            break;
        }
        if( ++v4 >= (_WORD *)v5 )
          goto LABEL_7;
      }
    }
    else
    {
      v10 = PreviousState[1] - (_QWORD)v4;
      while( 1 )
      {
        LODWORD(v3) = *(unsigned __int16 *)((char *)v4 + v10);
        if( *v4 != (_WORD)v3 )
          break;
        if( ++v4 >= (_WORD *)v5 )
          goto LABEL_7;
      }
    }
    goto LABEL_9;
  }
LABEL_7:
  LOBYTE(v3) = 1;
  return v3;
}

Referenced by:

AuthzBasepIsCompareRelevantAttribute
CmDeleteCommonClassRegKeyWorker
CmDeleteDeviceContainerRegKeyWorker
CmDeleteDeviceInterfaceRegKeyWorker
CmDeleteDevicePanelRegKeyWorker
CmDeleteDeviceRegKeyWorker
CmGetDeviceInterfacePathFormat
CmIsRootEnumeratedDevice
CmOpenCommonClassRegKeyWorker
CmOpenDeviceContainerRegKeyWorker
CmOpenDeviceInterfaceRegKeyWorker
CmOpenDevicePanelRegKeyWorker
CmOpenDeviceRegKeyWorker
CmValidateDeviceInterfaceName
CmpDoParseKey
IopBuildFullDriverPath
IopQueryRegistryKeySystemPath
IopValidateJunctionTarget
ObCheckRefTraceProcess
ObpIsUnsecureName
PiCreateDriverSwDeviceCallback
PiCreateRegistryPath
PiDevCfgMakeServiceBootStart
PiDrvDbQuerySystemPathWin32
PiDrvDbResolveKeyFilePaths
PiNormalizeDeviceText
PiOpenDirectoryWithRoot
PiPnpRtlEnumeratorFilterCallback
PopBatteryDeviceState
PopDirectedDripsDiagSanitizeHardwareId
PopFxBuildDripsBlockingDeviceList
RtlpProcessIFEOKeyFilter
SepAdtAuditObjectAccessWithContext
SepIsMinTCB
SepPotentialGlobalTableAttribute
SepValidateReferencedCachedHandles