KiHwPolicyFindDriverImage
NTSTATUS __stdcall KiHwPolicyFindDriverImage(_LOADER_PARAMETER_BLOCK *LoaderBlock){
char *v1;
int *i;
__int64 v3;
__int64 v4;
UNICODE_STRING String2;
*(_QWORD *)&String2.Length = 1703960i64;
v1 = (char *)LoaderBlock + 48;
String2.Buffer = L"hwpolicy.sys";
for( i = (int *)*((_QWORD *)LoaderBlock + 6); ; i = *(int **)i )
{
if( i == (int *)v1 )
{
LODWORD(v4) = 0;
return v4;
}
v3 = *((_QWORD *)i + 6);
if( v3 )
{
if( i[14] >= 0 && !(unsigned int)RtlCompareUnicodeString((const UNICODE_STRING *)(v3 + 88), &String2, 1u) )
break;
}
}
return *(_QWORD *)(v3 + 48);
}Referenced by:
KeHwPolicyLocateResource