PopEmModuleAddressMatchCallback

NTSTATUS __stdcall PopEmModuleAddressMatchCallback(INT64 *a1, INT64 a2, PCSZ *a3, INT64 a4, INT64 a5, INT64 a6){
  NTSTATUS v6; 
  INT64 v7; 
  const _UNICODE_STRING *v8; 
  _UNICODE_STRING String1; 
  _STRING DestinationString; 

  v6 = 1;
  DestinationString = 0i64;
  String1 = 0i64;
  if( (_DWORD)a2 == 1 )
  {
    if( a1 )
    {
      v7 = *a1;
      if( *a1 )
      {
        if( !(_DWORD)a6 && (_DWORD)a4 == 1 )
        {
          if( a3 )
          {
            if( *a3 )
            {
              if( *(_DWORD *)(v7 + 8) )
              {
                v8 = *(const _UNICODE_STRING **)v7;
                if( *(_QWORD *)v7 )
                {
                  RtlInitAnsiString(&DestinationString, *a3);
                  if( RtlAnsiStringToUnicodeString(&String1, &DestinationString, 1u) >= 0 )
                    v6 = (unsigned __int8)RtlEqualUnicodeString(&String1, v8, 1u) != 0 ? 2 : 0;
                }
              }
            }
          }
        }
      }
    }
  }
  RtlFreeAnsiString(&String1);
  return v6;
}

Referenced by: