MiFindUserSidHotPatchContext
_QWORD *__fastcall MiFindUserSidHotPatchContext(UINT8 *a1){
_QWORD *v1;
unsigned int v3;
int v4;
_QWORD a1a[3];
v1 = (_QWORD *)MiUserSidPatchLists;
if( !MiUserSidPatchLists )
return 0i64;
v3 = RtlLengthSid(a1);
a1a[0] = RtlHashBytes2(a1, v3);
a1a[1] = a1;
if( !v1 )
return 0i64;
do
{
v4 = MiCompareUserSidHotPatchNodes(a1a, (INT64)v1);
if( v4 >= 0 )
{
if( v4 <= 0 )
break;
v1 = (_QWORD *)v1[1];
}
else
{
v1 = (_QWORD *)*v1;
}
}
while( v1 );
if( v1 )
return v1;
else
return 0i64;
}Referenced by:
MiFindProcessImageHotPatchRecord
MiQueryLoadedPatches
MiUnloadHotPatchForUserSid