SdbReadEntryInformation
__int64 __fastcall SdbReadEntryInformation(__int64 a1, unsigned int a2, __int64 a3){
unsigned int v5;
__int64 v6;
unsigned int v7;
unsigned int FirstTag;
int v9;
int EntryFlags;
__int128 v11;
__int64 v12;
UINT64 v14;
INT64 v15;
_GUID pGuid;
UINT64 dwFlags[2];
__int64 v18;
LODWORD(v14) = 0;
v15 = 0i64;
v18 = 0i64;
pGuid = 0i64;
*(_OWORD *)dwFlags = 0i64;
v5 = SdbTagRefToTagID(a1, a2, (PVOID **)&v15, (int *)&v14);
if( !v5 )
{
AslLogCallPrintf(1ui64, "SdbReadEntryInformation", 0x1665ui64, "Failed to convert tagref 0x%x to tagid", a2);
return v5;
}
v6 = v15;
v7 = v14;
FirstTag = SdbFindFirstTag(v15, (unsigned int)v14, 36868);
v9 = FirstTag;
if( !FirstTag )
{
AslLogCallPrintf(1ui64, "SdbReadEntryInformation", 0x166Fui64, "Failed to read TAG_EXE_ID for tiExe 0x%x", v7);
return 0;
}
v5 = SdbReadBinaryTag(v6, FirstTag, &pGuid, 0x10u);
if( !v5 )
{
AslLogCallPrintf(1ui64, "SdbReadEntryInformation", 0x1679ui64, "Failed to read GUID referenced by 0x%x", v9);
return v5;
}
if( !(unsigned int)SdbGetDatabaseID(v6, &dwFlags[1]) )
{
AslLogCallPrintf(1ui64, "SdbReadEntryInformation", 0x1681ui64, "Failed to read GUID of the database");
return 0;
}
EntryFlags = SdbGetEntryFlags(&pGuid, dwFlags);
LODWORD(dwFlags[0]) &= -(EntryFlags != 0);
HIDWORD(dwFlags[0]) = SdbFindFirstTag(v6, v7, 28687);
if( a3 )
{
v11 = *(_OWORD *)dwFlags;
*(_GUID *)a3 = pGuid;
v12 = v18;
*(_OWORD *)(a3 + 16) = v11;
*(_QWORD *)(a3 + 32) = v12;
}
return 1;
}Referenced by:
PiIsDriverBlocked