RtlPcToFileName

VOID __fastcall RtlPcToFileName(_CM_KCB_UOW *KCBUoW){
  INT64 v1; 
  INT64 v2; 
  UNICODE_STRING *v4; 
  UINT64 v5; 
  UNICODE_STRING *v6; 
  UNICODE_STRING *v7; 
  UINT64 OldIrql; 
  LOBYTE(OldIrql) = 0;
  v4 = (UNICODE_STRING *)v1;
  MmLockLoadedModuleListShared((UINT8 *)&OldIrql, v1, v2);
  v6 = (UNICODE_STRING *)PsLoadedModuleList;
  if( PsLoadedModuleList )
  {
    while( v6 != (UNICODE_STRING *)&PsLoadedModuleList )
    {
      v7 = v6;
      v6 = *(UNICODE_STRING **)&v6->Length;
      v5 = *(_QWORD *)&v7[3].Length;
      if( (unsigned __int64)KCBUoW >= v5 && (unsigned __int64)KCBUoW < v5 + *(unsigned int *)&v7[4].Length )
      {
        RtlCopyUnicodeString(v4, (UNICODE_STRING *)((char *)v7 + 88), v6);
        break;
      }
    }
  }
  LOBYTE(v5) = OldIrql;
  MmUnlockLoadedModuleListShared(v5);
}

Referenced by: