PiUpdateDriverDBCache
VOID __stdcall PiUpdateDriverDBCache(UNICODE_STRING *FullPath, PVOID ImageBase, INT64 Status, GUID *Guid, GUID *Guida){
int v6;
IMAGE_NT_HEADERS *v7;
WCHAR *v8;
wchar_t *v9;
__int64 v10;
__int64 v11;
_QWORD *v12;
GUID v13;
wchar_t *v14;
WCHAR *v15;
wchar_t *v16;
UINT8 *PoolWithTag;
_QWORD *inserted;
_QWORD *v19;
__int64 v20;
__int64 v21;
_QWORD *v22;
void *v23;
__int128 Buffer;
__int128 v25;
_BYTE v26[24];
Buffer = 0i64;
v6 = (int)Guid;
v25 = 0i64;
memset(v26, 0, sizeof(v26));
v7 = RtlImageNtHeader(ImageBase);
if( !v7 )
return;
PiDDBCacheTable.TableContext = (void *)1;
v8 = wcsrchr(FullPath->Buffer, 0x5Cu);
if( v8 )
v9 = v8 + 1;
else
v9 = FullPath->Buffer;
v10 = -1i64;
*((_QWORD *)&v25 + 1) = v9;
v11 = -1i64;
do
++v11;
while( v9[v11] );
LOWORD(v25) = 2 * v11;
WORD1(v25) = 2 * v11;
LODWORD(v12) = RtlLookupElementGenericTableAvl(&PiDDBCacheTable, &Buffer);
if( v12 )
{
v21 = *v12;
if( *(_QWORD **)(*v12 + 8i64) != v12 )
goto LABEL_26;
v22 = (_QWORD *)v12[1];
if( (_QWORD *)*v22 != v12 )
goto LABEL_26;
*v22 = v21;
*(_QWORD *)(v21 + 8) = v22;
}
else
{
if( (unsigned int)RtlNumberGenericTableElementsAvl(&PiDDBCacheTable) < 0x100 )
goto LABEL_8;
v12 = PiDDBCacheList;
v20 = *(_QWORD *)PiDDBCacheList;
if( *((PVOID **)PiDDBCacheList + 1) != &PiDDBCacheList || *(PVOID *)(v20 + 8) != PiDDBCacheList )
goto LABEL_26;
PiDDBCacheList = *(PVOID *)PiDDBCacheList;
*(_QWORD *)(v20 + 8) = &PiDDBCacheList;
}
if( v12 )
{
v23 = (void *)v12[3];
RtlDeleteElementGenericTableAvl(&PiDDBCacheTable, v12);
ExFreePoolWithTag(v23, 0);
}
LABEL_8:
v13 = *Guida;
v14 = FullPath->Buffer;
*(_DWORD *)&v26[4] = v6;
*(GUID *)&v26[8] = v13;
*(_DWORD *)v26 = v7->FileHeader.TimeDateStamp;
v15 = wcsrchr(v14, 0x5Cu);
if( v15 )
v16 = v15 + 1;
else
v16 = FullPath->Buffer;
do
++v10;
while( v16[v10] );
WORD1(v25) = 2 * v10;
LOWORD(v25) = 2 * v10;
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned __int16)(2 * v10), 0x20207050ui64);
*((_QWORD *)&v25 + 1) = PoolWithTag;
if( PoolWithTag )
{
memmove(PoolWithTag, (UINT8 *)v16, (unsigned __int16)v25);
inserted = RtlInsertElementGenericTableAvl(&PiDDBCacheTable, &Buffer, 0x38ui64, 0i64);
if( inserted )
{
v19 = (_QWORD *)qword_140D2DBE8;
if( *(PVOID **)qword_140D2DBE8 == &PiDDBCacheList )
{
*inserted = &PiDDBCacheList;
inserted[1] = v19;
*v19 = inserted;
qword_140D2DBE8 = (__int64)inserted;
return;
}
LABEL_26:
__fastfail(3u);
}
}
}Referenced by:
PiIsDriverBlocked