KsepEvntLogShimsApplied

VOID __stdcall KsepEvntLogShimsApplied(_UNICODE_STRING *DriverName, _KSE_SHIM_INFO *Shims, UINT64 ShimCount){
  unsigned int v3; 
  __int64 v5; 
  unsigned __int16 v7; 
  _UNICODE_STRING *Paged; 
  _UNICODE_STRING *v9; 
  wchar_t *p_Length; 
  _UNICODE_STRING *v11; 
  _UNICODE_STRING *v12; 
  wchar_t *Buffer; 
  int v14; 
  unsigned int v15; 
  unsigned int v16; 
  unsigned int v17; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING *v19; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  _KSE_SHIM_INFO *v21; 
  __int64 v22; 
  unsigned int *v23; 
  __int64 v24; 
  wchar_t *v25; 
  int v26; 
  int v27; 

  v3 = 0;
  v19 = DriverName;
  v5 = (unsigned int)ShimCount;
  v17 = ShimCount;
  v7 = 0;
  Destination = 0i64;
  if( *(&stru_140CF2E80 + 627)
    && EtwEventEnabled(*(&stru_140CF2E80 + 627), &KseShimsApplied)
    && (_DWORD)v5
    && Shims
    && DriverName )
  {
    Paged = (_UNICODE_STRING *)KsepPoolAllocatePaged(94 * v5);
    v9 = Paged;
    if( Paged )
    {
      p_Length = &Paged[v17].Length;
      if( v17 )
      {
        do
        {
          v11 = &v9[v3];
          *v11 = 0i64;
          v11->Buffer = p_Length;
          p_Length += 39;
          v11->MaximumLength = 78;
          RtlStringFromGUIDEx((_GUID *)&Shims[20 * v3++], v11, 0);
          v7 += v11->Length + 4;
        }
        while( v3 < v17 );
        v12 = v19;
        if( v7 )
        {
          Destination.Buffer = (wchar_t *)KsepPoolAllocatePaged(v7);
          Buffer = Destination.Buffer;
          if( Destination.Buffer )
          {
            v14 = 0;
            Destination.MaximumLength = v7;
            if( v17 )
            {
              while( RtlAppendUnicodeStringToString(&Destination, &v9[v14]) >= 0 )
              {
                v15 = v17;
                if( v14 != v17 - 1 )
                {
                  if( RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\n") < 0 )
                    break;
                  v15 = v17;
                }
                if( ++v14 >= v15 )
                {
                  Buffer = Destination.Buffer;
                  goto LABEL_18;
                }
              }
            }
            else
            {
LABEL_18:
              UserData.Ptr = (unsigned __int64)v12->Buffer;
              v16 = v12->Length + 2;
              v22 = 4i64;
              UserData.Size = v16;
              v21 = Shims + 17;
              v23 = &v17;
              v24 = 4i64;
              v26 = Destination.Length + 2;
              v25 = Buffer;
              UserData.Reserved = 0;
              v27 = 0;
              EtwWriteEx(*(&stru_140CF2E80 + 627), &KseShimsApplied, 0i64, 0, 0, 0, 4u, &UserData);
            }
          }
        }
      }
      ExFreePoolWithTag(v9, 0x6145534Bu);
      _InterlockedIncrement(&dword_140C2A7E4);
    }
    if( Destination.Buffer )
    {
      ExFreePoolWithTag(Destination.Buffer, 0x6145534Bu);
      _InterlockedIncrement(&dword_140C2A7E4);
    }
  }
}

Referenced by: