KseInitialize

NTSTATUS __stdcall KseInitialize(_LOADER_PARAMETER_BLOCK *LoaderBlock, UINT64 Phase){
  int matched; 
  unsigned int v3; 
  signed __int32 v5; 
  _LOADER_PARAMETER_EXTENSION *v7; 
  _LOADER_PARAMETER_EXTENSION *Extension; 
  __int64 v9; 
  char v10; 
  __int64 v11; 
  PVOID DbHandleOut; 

  matched = 0;
  v3 = Phase;
  if( (_DWORD)Phase )
  {
    if( (_DWORD)Phase == 1 )
    {
      DbHandleOut = 0i64;
      EtwRegister((_LPCGUID)&KernelShimEngineProvider, 0i64, 0i64, (PREGHANDLE)&stru_140CF2E80 + 627);
      matched = KseShimDatabaseOpen(&DbHandleOut);
      if( matched >= 0 && DbHandleOut )
      {
        KseShimDatabaseClose(DbHandleOut);
      }
      else
      {
        dword_140C50328 |= 0x80u;
        matched = -1073741637;
      }
      if( matched >= 0 )
      {
        KseVersionLieInitialize();
        KseSkipDriverUnloadInitialize();
        KseZeroPoolInitialize();
        KseClearPCIDBitsInitialize();
        KseKasperskyInitialize();
        KseMemcpyInitialize();
        KseKernelPadSectionsOverrideInitialize();
        KseUserCetInitialize();
      }
    }
LABEL_29:
    v9 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
    HIDWORD(KsepHistoryMessages[v9]) = 0;
    LODWORD(KsepHistoryMessages[v9]) = 327940;
    if( (KsepDebugFlag & 1) != 0 )
      KsepDebugPrint(1i64, "KSE: Initialized phase 0x%x\n", v3);
    KsepLogInfo(1, "KSE: Initialized phase 0x%x\n", v3);
    if( InitIsWinPEMode )
      Engine |= 1u;
    if( matched >= 0 )
      return matched;
    goto LABEL_34;
  }
  v5 = _InterlockedCompareExchange(&dword_140C50324, 1, 0);
  if( v5 == 2 )
    return 0;
  if( v5 == 1 )
    return 259;
  if( KseShimDatabaseBootInitialize(LoaderBlock->Extension->DrvDBImage, LoaderBlock->Extension->DrvDBSize) < 0 )
    return -1073741823;
  if( !InitSafeBootMode && (v7 = LoaderBlock->Extension, v7->DrvDBImage) && v7->DrvDBSize )
  {
    matched = KsepEngineInitialize(&Engine);
    if( matched >= 0 )
    {
      matched = KsepMatchInitialize((INT64)LoaderBlock);
      if( matched >= 0 )
      {
        dword_140C50324 = 2;
        KseDriverScopeInitialize();
        goto LABEL_29;
      }
    }
  }
  else
  {
    if( ViVerifierEnabled )
      dword_140C50328 |= 0x40u;
    if( InitSafeBootMode )
      dword_140C50328 |= 0x100u;
    Extension = LoaderBlock->Extension;
    if( !Extension->DrvDBImage || !Extension->DrvDBSize )
      dword_140C50328 |= 0x80u;
    matched = -1073741637;
  }
LABEL_34:
  dword_140C50324 = 0;
  KsepEngineUninitialize(&Engine);
  v10 = KsepDebugFlag;
  v11 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
  if( matched == -1073741637 )
  {
    dword_140C2A864[2 * v11] = -1073741637;
    KsepHistoryErrors[2 * v11] = 327968;
    if( (v10 & 2) != 0 )
      KsepDebugPrint(
        1i64,
        "KSE: Engine not initialized(disabled explicitly, safe boot on, verifier on, WinPE mode or loader issue)\n");
    KsepLogError(
      1,
      "KSE: Engine not initialized(disabled explicitly, safe boot on, verifier on, WinPE mode or loader issue)\n");
  }
  else
  {
    dword_140C2A864[2 * v11] = matched;
    KsepHistoryErrors[2 * v11] = 327972;
    if( (v10 & 2) != 0 )
      KsepDebugPrint(1i64, "KSE: Initialization failed: 0x%x\n", (unsigned int)matched);
    KsepLogError(1, "KSE: Initialization failed: 0x%x\n", (unsigned int)matched);
  }
  return matched;
}

Referenced by: