KsepIsModuleShimmed

NTSTATUS __stdcall KsepIsModuleShimmed(_KSE_ENGINE *Engine, VOID *ModuleBaseAddress, _KSE_SHIMMED_MODULE **ModuleInfo){
  NTSTATUS v3; 
  _ETHREAD *CurrentThread; 
  _KSE_ENGINE *v8; 
  _KSE_ENGINE *v9; 
  _KSE_ENGINE *v11; 

  v3 = 0;
  if( !ModuleBaseAddress || !Engine || !ModuleInfo )
    return 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *ModuleInfo = 0i64;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(&stru_140C50350, 0i64);
  v8 = Engine + 8;
  v9 = *(_KSE_ENGINE **)v8;
  while( v9 != v8 )
  {
    v11 = v9;
    v9 = *(_KSE_ENGINE **)v9;
    if( *((VOID **)v11 + 2) == ModuleBaseAddress )
    {
      *ModuleInfo = v11;
      v3 = 1;
      break;
    }
  }
  if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&stru_140C50350);
  KeAbPostRelease(&stru_140C50350);
  KeLeaveCriticalRegion();
  return v3;
}

Referenced by: