SdbReadEntryInformation

__int64 __fastcall SdbReadEntryInformation(VOID *a1, UINT64 a2, __int64 a3){
  unsigned int BinaryTag; 
  _DB *v5; 
  unsigned int v6; 
  unsigned int FirstTag; 
  NTSTATUS EntryFlags; 
  _GUID v9; 
  __int64 v10; 
  INT8 *v12; 
  UINT64 v13; 
  UINT64 ptiWhich; 
  _DB *ppdb; 
  UINT8 pBuffer[16]; 
  _GUID pguidDB; 
  __int64 v18; 

  LODWORD(ptiWhich) = 0;
  ppdb = 0i64;
  v18 = 0i64;
  *(_OWORD *)pBuffer = 0i64;
  pguidDB = 0i64;
  BinaryTag = SdbTagRefToTagID(a1, a2, &ppdb, &ptiWhich);
  if( !BinaryTag )
  {
    v12 = (INT8 *)"Failed to convert tagref 0x%x to tagid";
    v13 = 5733i64;
LABEL_11:
    AslLogCallPrintf(1ui64, (INT8 *)"SdbReadEntryInformation", v13, v12);
    return BinaryTag;
  }
  v5 = ppdb;
  v6 = ptiWhich;
  FirstTag = SdbFindFirstTag(ppdb, (unsigned int)ptiWhich, 0x9004u);
  if( !FirstTag )
  {
    AslLogCallPrintf(
      1ui64,
      (INT8 *)"SdbReadEntryInformation",
      0x166Fui64,
      (INT8 *)"Failed to read TAG_EXE_ID for tiExe 0x%x");
    return 0;
  }
  BinaryTag = SdbReadBinaryTag(v5, FirstTag, pBuffer, 0x10ui64);
  if( !BinaryTag )
  {
    v12 = (INT8 *)"Failed to read GUID referenced by 0x%x";
    v13 = 5753i64;
    goto LABEL_11;
  }
  if( !SdbGetDatabaseID(v5, pguidDB.Data4) )
  {
    AslLogCallPrintf(
      1ui64,
      (INT8 *)"SdbReadEntryInformation",
      0x1681ui64,
      (INT8 *)"Failed to read GUID of the database");
    return 0;
  }
  EntryFlags = SdbGetEntryFlags((_GUID *)pBuffer, (UINT64 *)&pguidDB.Data1);
  pguidDB.Data1 &= -(EntryFlags != 0);
  *(_DWORD *)&pguidDB.Data2 = SdbFindFirstTag(v5, v6, 0x700Fu);
  if( a3 )
  {
    v9 = pguidDB;
    *(_OWORD *)a3 = *(_OWORD *)pBuffer;
    v10 = v18;
    *(_GUID *)(a3 + 16) = v9;
    *(_QWORD *)(a3 + 32) = v10;
  }
  return 1;
}

Referenced by:

PiIsDriverBlocked