SdbGetDatabaseMatch
UINT64 __fastcall SdbGetDatabaseMatch(
VOID *hSDB,
const WCHAR *szPath,
VOID *FileHandle,
VOID *pImageBase,
UINT64 cbImageSize){
int v8;
int v9;
__int64 v10;
unsigned int v11;
int v13;
__int64 v14;
const CHAR *v15;
UINT64 v16;
__int64 v17;
int v18;
unsigned int v19;
PVOID P;
int v21;
INT64 result[11];
unsigned int v23[32];
memset((INT64)result, 0i64);
memset((INT64)v23, 0i64);
P = 0i64;
v8 = 10;
v19 = 0;
if( pImageBase )
v8 = 26;
v21 = v8;
v9 = AslFileMappingCreate((UINT64 *)&P, szPath, (VOID *)0xFFFFFFFFFFFFFFFFi64, 0i64, 0i64);
if( v9 < 0 )
{
if( pImageBase )
{
v9 = AslFileMappingCreateFromImageView((UINT64 *)&P, (WCHAR *)szPath, pImageBase, cbImageSize);
if( v9 >= 0 )
goto LABEL_4;
v15 = "Failed to initialize file mapping from image view [%x]";
v16 = 4444i64;
}
else
{
v15 = "Failed to create initialize file mapping [%x]";
v16 = 4452i64;
}
LODWORD(v17) = v9;
AslLogCallPrintf(1ui64, "SdbGetDatabaseMatch", v16, v15, v17);
goto LABEL_8;
}
LABEL_4:
if( (unsigned int)SdbpCreateSearchDBContext(&v21, (const wchar_t **)P) )
{
v11 = SdbpSearchDB((__int64)hSDB, *((void **)hSDB + 1), v10, (__int64)&v21, v23, v18);
if( v11 > 0x10 )
{
AslLogCallPrintf(1ui64, "SdbGetDatabaseMatch", 0x117Cui64, "The database has more matches than SDB_MAX_EXES");
v11 = 16;
}
if( v11 )
{
v13 = v11 - 1;
v14 = v13;
if( v13 >= 0 )
{
while( (v23[2 * v14 + 1] & 2) != 0
|| (unsigned int)SdbTagIDToTagRef((__int64)hSDB, *((_QWORD *)hSDB + 1), v23[2 * v14], &v19) )
{
if( --v14 < 0 )
goto LABEL_8;
}
AslLogCallPrintf(1ui64, "SdbGetDatabaseMatch", 0x118Fui64, "Failed to convert tagid to tagref");
}
}
}
else
{
AslLogCallPrintf(1ui64, "SdbGetDatabaseMatch", 0x116Dui64, "Failed to create search DB context");
}
LABEL_8:
SdbpReleaseSearchDBContext(&v21);
AslFileMappingDelete((UINT64)P);
return v19;
}Referenced by:
PiIsDriverBlocked