LdrpKrnGetDataTableEntry

NTSTATUS __stdcall LdrpKrnGetDataTableEntry(PVOID Address){
  _ETHREAD *CurrentThread; 
  NTSTATUS v2; 
  PVOID *v4; 
  unsigned __int64 v5; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v2 = 0;
  if( !CurrentThread )
    return 0;
  --*((_WORD *)CurrentThread + 242);
  ExAcquireResourceSharedLite(&PsLoadedModuleResource, 1);
  v4 = (PVOID *)PsLoadedModuleList;
  if( !PsLoadedModuleList )
    return 0;
  while( 1 )
  {
    v5 = (unsigned __int64)v4[6];
    if( (unsigned __int64)Address >= v5 && (unsigned __int64)Address < v5 + *((unsigned int *)v4 + 16) )
      break;
    v4 = (PVOID *)*v4;
    if( v4 == &PsLoadedModuleList )
      goto LABEL_6;
  }
  v2 = (int)v4;
LABEL_6:
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v2;
}

Referenced by: