SdbpCheckForMatch
NTSTATUS __stdcall SdbpCheckForMatch(
VOID *hSDB,
_DB *pdb,
UINT64 tiExe,
tagSEARCHDBCONTEXT *pContext,
_MATCHMODE *pMatchMode,
UINT64 *pdwFlags){
unsigned int v6;
NTSTATUS v9;
int v11;
tagSEARCHDBCONTEXT v12;
_MATCHMODE *v14;
unsigned int FirstTag;
INT64 v16;
INT64 v17;
INT64 bMatchedOut;
v6 = tiExe;
v9 = 0;
LODWORD(bMatchedOut) = 0;
v11 = 0;
v12 = 1;
if( (unsigned int)SdbFindFirstTag(pdb, (unsigned int)tiExe, 0x100Du) )
v11 = 1;
if( SdbpMatchOsVersion(pdb, v6) )
{
LODWORD(v16) = 0;
if( SdbpMatchList(&bMatchedOut, hSDB, pdb, v6, pContext, v16, v17)
&& (v9 = bMatchedOut) != 0
&& SdbpGetExeEntryFlags(pdb, v6, pdwFlags) )
{
v14 = pMatchMode;
if( pMatchMode )
{
FirstTag = SdbFindFirstTag(pdb, v6, 0x3001u);
if( FirstTag )
*v14 = SdbReadWORDTag(pdb, FirstTag, 2u);
else
*v14 = MATCHMODE_ADDITIVE;
}
}
else
{
v9 = 0;
}
}
if( !pContext[20] || v11 )
v12 = 0;
pContext[20] = v12;
return v9;
}Referenced by:
SdbpCheckExe
SdbpCheckKObject