SdbpSearchDB
UINT64 __stdcall SdbpSearchDB(VOID *hSDB, _DB *pdb, tagSEARCHDBCONTEXT *pContext, tagEXE_ENTRY_INFO *pExeEntryInfo){
tagEXE_ENTRY_INFO *v4;
unsigned int v7;
WCHAR *v9;
UINT16 v10;
__int64 v11;
__int64 v12;
unsigned int FirstStringIndexedTag;
unsigned int v14;
UINT16 v15;
NTSTATUS v17;
unsigned int v18;
unsigned int i;
NTSTATUS v20;
unsigned int FirstTag;
UINT64 v22;
__int64 v23;
unsigned int FirstNamedTag;
NTSTATUS v25;
unsigned int v26;
unsigned int j;
NTSTATUS v28;
WCHAR *pszName;
_FIND_INFO pFindInfo[4];
__int128 v31;
__int64 v32;
UINT64 pdwNumExes;
_MATCHMODE pMatchMode;
tagEXE_ENTRY_INFO *v36;
UINT64 tiParent;
v4 = v36;
pMatchMode = MATCHMODE_UNKNOWN;
LODWORD(tiParent) = 0;
v32 = 0i64;
v7 = 0;
LODWORD(pdwNumExes) = 0;
*(_OWORD *)pFindInfo = 0i64;
v31 = 0i64;
memset(v36, 0i64, 0x80u);
v9 = (WCHAR *)pExeEntryInfo[5];
pszName = v9;
v11 = 16i64;
if( (unsigned int)SdbGetIndex(pdb, 0x7007u, 0x600Bu, 0i64) )
{
for( i = SdbpFindFirstIndexedWildCardTag(pdb, 0x7007ui64, v10, v9, pFindInfo);
i;
i = SdbpFindNextIndexedWildCardTag(pdb, pFindInfo) )
{
v20 = SdbpCheckExe(
hSDB,
pdb,
i,
&pdwNumExes,
(tagSEARCHDBCONTEXT *)pExeEntryInfo,
AM_ADDITIVE_ONLY,
&pMatchMode,
v4);
v7 = pdwNumExes;
if( v20 )
{
if( pMatchMode != MATCHMODE_ADDITIVE )
goto LABEL_7;
}
else if( (unsigned int)pdwNumExes > 0x10 )
{
goto LABEL_15;
}
}
}
if( (unsigned int)SdbGetIndex(pdb, 0x7007u, 0x6001u, 0i64) )
{
v12 = 1i64;
FirstStringIndexedTag = SdbFindFirstStringIndexedTag(pdb, 0x7007u, 0x6001u, v9, pFindInfo);
goto LABEL_4;
}
v12 = 0i64;
FirstTag = SdbFindFirstTag(pdb, 0i64, 0x7001u);
LODWORD(tiParent) = FirstTag;
if( !FirstTag )
{
v22 = 3472i64;
LABEL_30:
AslLogCallPrintf(1ui64, (INT8 *)"SdbpSearchDB", v22, (INT8 *)"No DATABASE tag found");
goto LABEL_7;
}
FirstStringIndexedTag = SdbFindFirstNamedTag(pdb, FirstTag, 0x7007u, 0x6001u, v9);
LABEL_4:
while( 1 )
{
v14 = FirstStringIndexedTag;
if( !FirstStringIndexedTag )
break;
v17 = SdbpCheckExe(
hSDB,
pdb,
FirstStringIndexedTag,
&pdwNumExes,
(tagSEARCHDBCONTEXT *)pExeEntryInfo,
AM_NORMAL,
&pMatchMode,
v4);
v7 = pdwNumExes;
if( v17 )
{
if( pMatchMode != MATCHMODE_ADDITIVE )
goto LABEL_7;
}
else if( (unsigned int)pdwNumExes > 0x10 )
{
goto LABEL_15;
}
if( v12 )
FirstStringIndexedTag = SdbFindNextStringIndexedTag(pdb, pFindInfo);
else
FirstStringIndexedTag = SdbpFindNextNamedTag(pdb, (unsigned int)tiParent, v14, 0x6001u, pszName);
}
if( pExeEntryInfo[6] )
{
if( (unsigned int)SdbGetIndex(pdb, 0x7007u, 0x6020u, 0i64) )
{
v23 = 1i64;
FirstNamedTag = SdbFindFirstStringIndexedTag(pdb, 0x7007u, 0x6020u, *(WCHAR **)&pExeEntryInfo[6], pFindInfo);
goto LABEL_44;
}
v23 = 0i64;
LODWORD(tiParent) = SdbFindFirstTag(pdb, 0i64, 0x7001u);
if( (_DWORD)tiParent )
{
v22 = 3544i64;
goto LABEL_30;
}
FirstNamedTag = SdbFindFirstNamedTag(pdb, 0i64, 0x7007u, 0x6020u, *(WCHAR **)&pExeEntryInfo[6]);
LABEL_44:
while( 1 )
{
v26 = FirstNamedTag;
if( !FirstNamedTag )
break;
v25 = SdbpCheckExe(
hSDB,
pdb,
FirstNamedTag,
&pdwNumExes,
(tagSEARCHDBCONTEXT *)pExeEntryInfo,
AM_NORMAL,
&pMatchMode,
v4);
v7 = pdwNumExes;
if( v25 )
{
if( pMatchMode != MATCHMODE_ADDITIVE )
goto LABEL_7;
}
else if( (unsigned int)pdwNumExes > 0x10 )
{
goto LABEL_15;
}
if( v23 )
FirstNamedTag = SdbFindNextStringIndexedTag(pdb, pFindInfo);
else
FirstNamedTag = SdbpFindNextNamedTag(
pdb,
(unsigned int)tiParent,
v26,
0x6020u,
*(const WCHAR **)&pExeEntryInfo[6]);
}
}
if( (unsigned int)SdbGetIndex(pdb, 0x7007u, 0x600Bu, 0i64) )
{
for( j = SdbpFindFirstIndexedWildCardTag(pdb, 0x7007ui64, v15, pszName, pFindInfo);
j;
j = SdbpFindNextIndexedWildCardTag(pdb, pFindInfo) )
{
v28 = SdbpCheckExe(
hSDB,
pdb,
j,
&pdwNumExes,
(tagSEARCHDBCONTEXT *)pExeEntryInfo,
AM_NO_ADDITIVE,
&pMatchMode,
v4);
v7 = pdwNumExes;
if( v28 )
{
if( pMatchMode != MATCHMODE_ADDITIVE )
break;
}
else if( (unsigned int)pdwNumExes > 0x10 )
{
goto LABEL_15;
}
}
}
LABEL_7:
if( v7 > 0x10 || (v11 = v7) != 0 )
{
do
{
LABEL_15:
v18 = SdbFindFirstTag(pdb, v4->tiExe, 0x6006u);
if( v18 )
SdbGetStringTagPtr(pdb, v18);
++v4;
--v11;
}
while( v11 );
}
return v7;
}Referenced by:
SdbGetDatabaseMatch