RtlPcToFilePath

NTSTATUS __stdcall RtlPcToFilePath(VOID *PcValue, _UNICODE_STRING *FilePath){
  _ETHREAD *CurrentThread; 
  INT64 *v5; 
  NTSTATUS v6; 
  INT64 *v7; 
  unsigned __int64 v8; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceSharedLite((UINT64)&PsLoadedModuleResource, 1);
  v5 = (INT64 *)PsLoadedModuleList;
  v6 = 0;
  if( PsLoadedModuleList )
  {
    while( v5 != &PsLoadedModuleList )
    {
      v7 = v5;
      v5 = (INT64 *)*v5;
      v8 = v7[6];
      if( (unsigned __int64)PcValue >= v8 && (unsigned __int64)PcValue < v8 + *((unsigned int *)v7 + 16) )
      {
        RtlCopyUnicodeString(FilePath, (PCUNICODE_STRING)(v7 + 9));
        goto LABEL_7;
      }
    }
  }
  v6 = -1073741275;
LABEL_7:
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegion();
  return v6;
}

Referenced by: