RtlPcToFileName

NTSTATUS __stdcall RtlPcToFileName(VOID *PcValue, _UNICODE_STRING *FileName){
  NTSTATUS v3; 
  UINT64 v5; 
  INT64 *v6; 
  INT64 *v7; 
  UINT64 OldIrql; 

  v3 = 0;
  LOBYTE(OldIrql) = 0;
  MmLockLoadedModuleListShared((unsigned __int8 *)&OldIrql);
  v6 = (INT64 *)PsLoadedModuleList;
  if( PsLoadedModuleList )
  {
    while( v6 != &PsLoadedModuleList )
    {
      v7 = v6;
      v6 = (INT64 *)*v6;
      v5 = v7[6];
      if( (unsigned __int64)PcValue >= v5 && (unsigned __int64)PcValue < v5 + *((unsigned int *)v7 + 16) )
      {
        RtlCopyUnicodeString(FileName, (PCUNICODE_STRING)(v7 + 11));
        goto LABEL_6;
      }
    }
  }
  v3 = -1073741275;
LABEL_6:
  LOBYTE(v5) = OldIrql;
  MmUnlockLoadedModuleListShared(v5);
  return v3;
}

Referenced by: