PiLookupInDDBCache
NTSTATUS __stdcall PiLookupInDDBCache(_UNICODE_STRING *FullPath, VOID *ImageBase, _GUID *EntryGuid){
_OWORD *v3;
_OWORD *v5;
NTSTATUS v7;
__int64 v8;
__int64 v9;
WORD *v10;
wchar_t *v11;
__int64 v12;
VOID ***v13;
VOID **v15;
VOID **v16;
VOID ****v17;
__int128 Buffer;
__int128 v19;
__int128 v20;
__int64 v21;
v21 = 0i64;
Buffer = 0i64;
PiDDBCacheTable.TableContext = 0i64;
v5 = v3;
v19 = 0i64;
v7 = -1073741823;
v20 = 0i64;
if( !(unsigned __int8)RtlIsGenericTableEmptyAvl(&PiDDBCacheTable) )
{
LODWORD(v8) = RtlImageNtHeader((UINT64)ImageBase);
v9 = v8;
if( v8 )
{
v10 = wcsrchr(FullPath->Buffer, 92);
v11 = v10 ? v10 + 1 : FullPath->Buffer;
*((_QWORD *)&v19 + 1) = v11;
v12 = -1i64;
do
++v12;
while( v11[v12] );
LOWORD(v19) = 2 * v12;
WORD1(v19) = 2 * v12;
LODWORD(v20) = *(_DWORD *)(v9 + 8);
v13 = (VOID ***)RtlLookupElementGenericTableAvl(&PiDDBCacheTable, &Buffer);
if( v13 )
{
v15 = *v13;
if( (*v13)[1] != v13
|| (v16 = v13[1], *v16 != v13)
|| (*v16 = v15, v15[1] = v16, v17 = (VOID ****)qword_140D2DBE8, *(PVOID **)qword_140D2DBE8 != &PiDDBCacheList) )
{
__fastfail(3u);
}
*v13 = &PiDDBCacheList;
v13[1] = (VOID **)v17;
*v17 = v13;
qword_140D2DBE8 = (__int64)v13;
v7 = *((_DWORD *)v13 + 9);
if( v5 )
*v5 = *(_OWORD *)(v13 + 5);
}
}
}
return v7;
}Referenced by:
PpCheckInDriverDatabase