KsepGetShimsForDriver

NTSTATUS __stdcall KsepGetShimsForDriver(
        _UNICODE_STRING *DriverName,
        _UNICODE_STRING *DriverPath,
        VOID *BaseAddress,
        UINT64 ImageSize,
        VOID **Shims,
        UINT64 *ShimCount){
  unsigned int v9; 
  int ShimsFromRegistry; 
  _KSE_SHIMMED_MODULE *v12; 
  _UNICODE_STRING *v13; 
  unsigned int v14; 
  _QWORD *Paged; 
  _QWORD *v16; 
  _ETHREAD *CurrentThread; 
  _QWORD *v18; 
  __int64 v19; 
  UINT64 v20; 
  _UNICODE_STRING *ShimsOut; 
  _KSE_SHIMMED_MODULE *ModuleInfo; 

  ShimsOut = 0i64;
  LODWORD(v20) = 0;
  *Shims = 0i64;
  *(_DWORD *)ShimCount = 0;
  ModuleInfo = 0i64;
  v9 = ImageSize;
  if( KsepIsModuleShimmed(&Engine, BaseAddress, &ModuleInfo) )
  {
    v12 = ModuleInfo;
    *Shims = (VOID *)*((_QWORD *)ModuleInfo + 4);
    *(_DWORD *)ShimCount = v12[6];
    return 0;
  }
  ShimsFromRegistry = KsepEngineGetShimsFromRegistry(&Engine, DriverName, (_KSE_SHIM_INFO **)&ShimsOut, &v20);
  if( ShimsFromRegistry == -1073741275 )
    ShimsFromRegistry = KsepDbGetDriverShims(DriverPath, BaseAddress, v9, &ShimsOut, &v20);
  if( ShimsFromRegistry < 0 )
    goto LABEL_5;
  v13 = ShimsOut;
  v14 = v20;
  ShimsFromRegistry = KsepResolveApplicableShimsForDriver((_KSE_SHIM_INFO *)ShimsOut, (unsigned int)v20);
  if( ShimsFromRegistry < 0 )
  {
LABEL_12:
    if( v13 && v14 )
      KsepDbFreeDriverShims((_KSE_SHIM_INFO *)v13, v14);
    goto LABEL_6;
  }
  Paged = KsepPoolAllocatePaged(0x28ui64);
  v16 = Paged;
  if( !Paged )
  {
    ShimsFromRegistry = -1073741670;
    goto LABEL_12;
  }
  Paged[4] = v13;
  *((_DWORD *)Paged + 6) = v14;
  Paged[2] = BaseAddress;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(&stru_140C50350, 0i64);
  v18 = qword_140C50348;
  if( (_UNKNOWN *)*qword_140C50348 != &unk_140C50340 )
    __fastfail(3u);
  *v16 = &unk_140C50340;
  v16[1] = v18;
  *v18 = v16;
  qword_140C50348 = v16;
  if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&stru_140C50350);
  KeAbPostRelease(&stru_140C50350);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
LABEL_5:
  *Shims = ShimsOut;
  *(_DWORD *)ShimCount = v20;
LABEL_6:
  if( ShimsFromRegistry >= 0 )
  {
    v19 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
    HIDWORD(KsepHistoryMessages[v19]) = 0;
    LODWORD(KsepHistoryMessages[v19]) = 459112;
    if( (KsepDebugFlag & 1) != 0 )
      KsepDebugPrint(7i64, "KSE: got shim(s) for driver [%ws]\n", DriverName->Buffer);
    KsepLogInfo(7, "KSE: got shim(s) for driver [%ws]\n", DriverName->Buffer);
  }
  return ShimsFromRegistry;
}

Referenced by: