PiLookupInDDBCache
NTSTATUS __stdcall PiLookupInDDBCache(UNICODE_STRING *FullPath, PVOID ImageBase, GUID *EntryGuid){
_OWORD *v3;
_OWORD *v5;
NTSTATUS v7;
IMAGE_NT_HEADERS *v8;
WCHAR *v9;
wchar_t *v10;
__int64 v11;
__int64 v12;
__int64 v14;
_QWORD *v15;
__int64 *v16;
__int128 Buffer;
__int128 v18;
__int128 v19;
__int64 v20;
v20 = 0i64;
Buffer = 0i64;
PiDDBCacheTable.TableContext = 0i64;
v5 = v3;
v18 = 0i64;
v7 = -1073741823;
v19 = 0i64;
if( !RtlIsGenericTableEmptyAvl(&PiDDBCacheTable) )
{
v8 = RtlImageNtHeader(ImageBase);
if( v8 )
{
v9 = wcsrchr(FullPath->Buffer, 0x5Cu);
v10 = v9 ? v9 + 1 : FullPath->Buffer;
*((_QWORD *)&v18 + 1) = v10;
v11 = -1i64;
do
++v11;
while( v10[v11] );
LOWORD(v18) = 2 * v11;
WORD1(v18) = 2 * v11;
LODWORD(v19) = v8->FileHeader.TimeDateStamp;
LODWORD(v12) = RtlLookupElementGenericTableAvl(&PiDDBCacheTable, &Buffer);
if( v12 )
{
v14 = *(_QWORD *)v12;
if( *(_QWORD *)(*(_QWORD *)v12 + 8i64) != v12
|| (v15 = *(_QWORD **)(v12 + 8), *v15 != v12)
|| (*v15 = v14,
*(_QWORD *)(v14 + 8) = v15,
v16 = (__int64 *)qword_140D2DBE8,
*(PVOID **)qword_140D2DBE8 != &PiDDBCacheList) )
{
__fastfail(3u);
}
*(_QWORD *)v12 = &PiDDBCacheList;
*(_QWORD *)(v12 + 8) = v16;
*v16 = v12;
qword_140D2DBE8 = v12;
v7 = *(_DWORD *)(v12 + 36);
if( v5 )
*v5 = *(_OWORD *)(v12 + 40);
}
}
}
return v7;
}Referenced by:
PpCheckInDriverDatabase