RtlLookupEntryHashTable
_LIST_ENTRY *__fastcall RtlLookupEntryHashTable(
_RTL_DYNAMIC_HASH_TABLE *HashTable,
UINT64 Signature,
_RTL_DYNAMIC_HASH_TABLE_CONTEXT *Context){
_RTL_DYNAMIC_HASH_TABLE_CONTEXT *v4;
unsigned int Shift;
unsigned int v7;
unsigned int v8;
_QWORD *Directory;
_LIST_ENTRY *v10;
_LIST_ENTRY **p_Flink;
_LIST_ENTRY *i;
UINT64 Flink;
_LIST_ENTRY *result;
unsigned int v15;
char v16;
v4 = (_RTL_DYNAMIC_HASH_TABLE_CONTEXT *)&v16;
Shift = HashTable->Shift;
if( Context )
v4 = Context;
v7 = (69069 * ((unsigned int)Signature >> Shift) + 1) & 0xFFFF0000 | ((1103515245 * ((unsigned int)Signature >> Shift)
+ 12345) >> 16);
v8 = v7 & HashTable->DivisorMask;
if( v8 < HashTable->Pivot )
v8 = v7 & ((2 * HashTable->DivisorMask) | 1);
Directory = HashTable->Directory;
if( HashTable->TableSize > 0x80 )
{
_BitScanReverse(&v15, v8 + 128);
v8 = (v8 + 128) ^ (1 << v15);
Directory = (_QWORD *)Directory[v15 - 7];
}
v10 = (_LIST_ENTRY *)&Directory[2 * v8];
p_Flink = &v10->Flink;
for( i = v10->Flink; i != v10; i = i->Flink )
{
Flink = (UINT64)i[1].Flink;
if( Flink && Flink >= Signature )
break;
p_Flink = &i->Flink;
}
v4->ChainHead = v10;
v4->PrevLinkage = (_LIST_ENTRY *)p_Flink;
v4->Signature = Signature;
result = *p_Flink;
if( v10 == *p_Flink || result[1].Flink != (_LIST_ENTRY *)Signature )
return 0i64;
return result;
}Referenced by:
SepFindMatchingCachedHandlesEntry
SepFindMatchingLowBoxNumberEntry
SepFindMatchingLuidEntry
SepFindSharedSidEntry
SepRmReferenceFindCap