KsepGetShimCallbacksForDriver

NTSTATUS __stdcall KsepGetShimCallbacksForDriver(VOID *BaseAddress, _KSE_IO_CALLBACKS *IoCallbacks){
  NTSTATUS v2; 
  __int64 v6; 
  unsigned int v7; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  _DWORD *v13; 
  __int64 v14; 
  __int64 v15; 
  _DWORD *v16; 
  unsigned int v17; 
  __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  int v24; 
  __int64 v25; 
  _KSE_SHIMMED_MODULE *ModuleInfo; 

  v2 = 0;
  ModuleInfo = 0i64;
  if( !IoCallbacks )
  {
    v6 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    dword_140C2A864[2 * v6] = -1073740768;
    KsepHistoryErrors[2 * v6] = 459523;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("IoCallbacks != NULL", "minkernel\\ntos\\kshim\\kseloader.c", 771i64, 0i64);
  }
  memset(IoCallbacks, 0i64, 0x100u);
  if( !KsepIsModuleShimmed(&Engine, BaseAddress, &ModuleInfo) )
    return -1073741275;
  v7 = ModuleInfo[6];
  v8 = *((_QWORD *)ModuleInfo + 4);
  if( v7 )
  {
    v9 = v8 + 72;
    v25 = (unsigned int)ModuleInfo[6];
    v23 = v8 + 72;
    v10 = v7;
    while( 1 )
    {
      if( (*(_DWORD *)(*(_QWORD *)v9 + 28i64) & 4) == 0 )
      {
        v11 = *(_QWORD *)(*(_QWORD *)v9 + 16i64);
        if( !v11 )
        {
          v12 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
          dword_140C2A864[2 * v12] = -1073740768;
          KsepHistoryErrors[2 * v12] = 459576;
          if( (KsepDebugFlag & 4) != 0 )
          {
            RtlAssert("CurrentShim != NULL", "minkernel\\ntos\\kshim\\kseloader.c", 824i64, 0i64);
            v10 = v25;
          }
        }
        v13 = *(_DWORD **)(v11 + 48);
        v14 = 0i64;
        v24 = 0;
        if( *v13 != 4 )
          break;
      }
LABEL_48:
      v9 += 80i64;
      --v10;
      v23 = v9;
      v25 = v10;
      if( !v10 )
        goto LABEL_49;
    }
    v15 = 0i64;
    while( 1 )
    {
      v16 = v13;
      if( v13[v15] == 3 )
      {
        v17 = 0;
        if( **(_DWORD **)&v13[v15 + 4] != 2 )
          break;
      }
LABEL_46:
      v14 = (unsigned int)(v14 + 1);
      v13 = v16;
      v24 = v14;
      v15 = 6 * v14;
      if( v16[6 * v14] == 4 )
      {
        v9 = v23;
        v10 = v25;
        goto LABEL_48;
      }
    }
    v18 = 0i64;
    while( 1 )
    {
      v19 = *(_QWORD *)&v13[v15 + 4];
      switch( *(_DWORD *)(v18 + v19 + 8) )
      {
        case 1:
          if( *(_QWORD *)IoCallbacks )
          {
            v21 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
            KsepHistoryErrors[2 * (unsigned int)v21] = 459604;
            goto LABEL_40;
          }
          *(_QWORD *)IoCallbacks = *(_QWORD *)(v18 + v19 + 16);
          break;
        case 2:
          if( *((_QWORD *)IoCallbacks + 1) )
          {
            v21 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
            KsepHistoryErrors[2 * (unsigned int)v21] = 459619;
            goto LABEL_40;
          }
          *((_QWORD *)IoCallbacks + 1) = *(_QWORD *)(v18 + v19 + 16);
          break;
        case 3:
          if( *((_QWORD *)IoCallbacks + 2) )
          {
            v21 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
            KsepHistoryErrors[2 * (unsigned int)v21] = 459634;
            goto LABEL_40;
          }
          *((_QWORD *)IoCallbacks + 2) = *(_QWORD *)(v18 + v19 + 16);
          break;
        case 4:
          if( *((_QWORD *)IoCallbacks + 3) )
          {
            v21 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
            KsepHistoryErrors[2 * (unsigned int)v21] = 459649;
            goto LABEL_40;
          }
          *((_QWORD *)IoCallbacks + 3) = *(_QWORD *)(v18 + v19 + 16);
          break;
        default:
          v20 = (unsigned int)(*(_DWORD *)(v18 + v19 + 8) - 100);
          if( (unsigned int)v20 > 0x1B )
          {
            v22 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
            dword_140C2A864[2 * v22] = -1073741811;
            KsepHistoryErrors[2 * v22] = 459680;
            if( (KsepDebugFlag & 2) != 0 )
              KsepDebugPrint(9i64, "KSE: Invalid callback code encountered: %u\n", *(unsigned int *)(v18 + v19 + 8));
            KsepLogError(9, "KSE: Invalid callback code encountered: %u\n", *(unsigned int *)(v18 + v19 + 8));
            break;
          }
          if( *(_QWORD *)&IoCallbacks[2 * v20 + 8] )
          {
            v21 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
            KsepHistoryErrors[2 * (unsigned int)v21] = 459667;
LABEL_40:
            dword_140C2A864[2 * v21] = -1073741823;
            if( (KsepDebugFlag & 2) != 0 )
              KsepDebugPrint(9i64, "KSE: Two shims are hooking same callback! \n", v14);
            KsepLogError(9, "KSE: Two shims are hooking same callback! \n", v14);
            break;
          }
          *(_QWORD *)&IoCallbacks[2 * (unsigned int)v20 + 8] = *(_QWORD *)(v18 + v19 + 16);
          break;
      }
      v16 = *(_DWORD **)(v11 + 48);
      ++v17;
      v13 = v16;
      v18 = 32i64 * v17;
      if( *(_DWORD *)(v18 + *(_QWORD *)&v16[v15 + 4]) == 2 )
      {
        LODWORD(v14) = v24;
        goto LABEL_46;
      }
    }
  }
LABEL_49:
  KsepHistoryMessages[((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F] = 459700i64;
  if( (KsepDebugFlag & 1) != 0 )
    KsepDebugPrint(9i64, "KSE: GetShimCallbacks succeeded\n");
  KsepLogInfo(9, "KSE: GetShimCallbacks succeeded\n");
  return v2;
}

Referenced by: