KiPcToFileHeader

VOID *__stdcall KiPcToFileHeader(
        VOID *PcValue,
        _LDR_DATA_TABLE_ENTRY **DataTableEntry,
        UINT64 DriversOnly,
        UINT8 *InKernelOrHal){
  int v5; 
  _LIST_ENTRY *p_LoadOrderListHead; 
  _LDR_DATA_TABLE_ENTRY *Flink; 
  VOID *v10; 
  unsigned int v11; 
  _LDR_DATA_TABLE_ENTRY *v12; 
  unsigned __int64 DllBase; 

  v5 = DriversOnly;
  if( (unsigned int)InitializationPhase >= 2 )
    p_LoadOrderListHead = (_LIST_ENTRY *)&PsLoadedModuleList;
  else
    p_LoadOrderListHead = &KeLoaderBlock_0->LoadOrderListHead;
  Flink = (_LDR_DATA_TABLE_ENTRY *)p_LoadOrderListHead->Flink;
  v10 = 0i64;
  *InKernelOrHal = 0;
  if( Flink )
  {
    v11 = 0;
    while( Flink != (_LDR_DATA_TABLE_ENTRY *)p_LoadOrderListHead )
    {
      if( !MmIsAddressValidEx((INT64)Flink) )
        return 0i64;
      if( ++v11 <= 2 && v5 == 1 )
      {
        Flink = (_LDR_DATA_TABLE_ENTRY *)Flink->InLoadOrderLinks.Flink;
      }
      else
      {
        v12 = Flink;
        Flink = (_LDR_DATA_TABLE_ENTRY *)Flink->InLoadOrderLinks.Flink;
        DllBase = (unsigned __int64)v12->DllBase;
        if( (unsigned __int64)PcValue >= DllBase && (unsigned __int64)PcValue < DllBase + v12->SizeOfImage )
        {
          *DataTableEntry = v12;
          v10 = (VOID *)DllBase;
          if( v11 <= 2 )
            *InKernelOrHal = 1;
          return v10;
        }
      }
    }
  }
  return v10;
}

Referenced by: