KseDriverUnloadImage

NTSTATUS __stdcall KseDriverUnloadImage(_KLDR_DATA_TABLE_ENTRY *DataTableEntry){
  void *DllBase; 
  _ETHREAD *CurrentThread; 
  _KSE_SHIMMED_MODULE *v5; 
  __int64 v6; 
  _KSE_SHIMMED_MODULE *v7; 
  _KSE_SHIMMED_MODULE v8; 
  __int64 v9; 
  void(__fastcall *v10)(void *); 
  __int64 v11; 
  __int64 *v12; 
  __int64 v13; 
  int v14; 
  int v15; 
  __int64 *v16; 
  __int64 **v17; 
  __int64 v18; 
  _KSE_SHIMMED_MODULE **v19; 
  UINT64 v20; 
  __int64 v21; 
  _KSE_SHIMMED_MODULE *v22; 
  __int64 v23; 
  _ADAPTER_OBJECT *v24; 
  __int64 v25; 
  _KSE_SHIMMED_MODULE *v26; 
  __int64 v27; 
  _KSE_SHIMMED_MODULE *ModuleInfo; 

  ModuleInfo = 0i64;
  if( !DataTableEntry )
    return -1073741811;
  if( dword_140C50324 != 2 )
    return -1073741637;
  if( (Engine & 1) != 0 )
    return -1073741637;
  DllBase = DataTableEntry->DllBase;
  if( MmIsSessionAddress(DllBase) == 1 )
    return -1073741637;
  if( KsepIsModuleShimmed(&Engine, DllBase, &ModuleInfo) && ModuleInfo )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&stru_140C50350, 0i64);
    v5 = ModuleInfo;
    v6 = 0i64;
    v7 = ModuleInfo + 6;
    v8 = ModuleInfo[6];
    if( v8 )
    {
      do
      {
        v9 = *(_QWORD *)(*((_QWORD *)v5 + 4) + 80 * v6 + 72);
        if( (*(_DWORD *)(v9 + 28) & 4) == 0 )
        {
          v10 = *(void(__fastcall **)(void *))(*(_QWORD *)(v9 + 16) + 32i64);
          if( v10 )
            v10(DataTableEntry->DllBase);
        }
        v8 = *v7;
        v6 = (unsigned int)(v6 + 1);
      }
      while( (unsigned int)v6 < *v7 );
    }
    v11 = 0i64;
    if( v8 )
    {
      do
      {
        v12 = *(__int64 **)(*((_QWORD *)v5 + 4) + 80 * v11 + 72);
        if( !*((_DWORD *)v12 + 6) )
        {
          v13 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
          dword_140C2A864[2 * v13] = -1073740768;
          KsepHistoryErrors[2 * v13] = 460173;
          if( (KsepDebugFlag & 4) != 0 )
            RtlAssert("RegisteredShim->RefCount > 0", "minkernel\\ntos\\kshim\\kseloader.c", 1421i64, 0i64);
        }
        v14 = *((_DWORD *)v12 + 7);
        v15 = *((_DWORD *)v12 + 6) - 1;
        *((_DWORD *)v12 + 6) = v15;
        if( (v14 & 4) != 0 && !v15 )
        {
          v16 = (__int64 *)*v12;
          if( *(__int64 **)(*v12 + 8) != v12 )
            goto LABEL_43;
          v17 = (__int64 **)v12[1];
          if( *v17 != v12 )
            goto LABEL_43;
          *v17 = v16;
          v16[1] = (__int64)v17;
        }
        v11 = (unsigned int)(v11 + 1);
      }
      while( (unsigned int)v11 < *v7 );
      v5 = ModuleInfo;
    }
    v18 = *(_QWORD *)v5;
    if( *(_KSE_SHIMMED_MODULE **)(*(_QWORD *)v5 + 8i64) != v5
      || (v19 = (_KSE_SHIMMED_MODULE **)*((_QWORD *)v5 + 1), *v19 != v5) )
    {
LABEL_43:
      __fastfail(3u);
    }
    *v19 = (_KSE_SHIMMED_MODULE *)v18;
    *(_QWORD *)(v18 + 8) = v19;
    if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&stru_140C50350);
    KeAbPostRelease(&stru_140C50350);
    KeLeaveCriticalRegion();
    v20 = (unsigned int)*v7;
    v21 = 0i64;
    if( (_DWORD)v20 )
    {
      v22 = ModuleInfo;
      do
      {
        v23 = *(_QWORD *)(*((_QWORD *)v22 + 4) + 80 * v21 + 72);
        v24 = *(_ADAPTER_OBJECT **)(v23 + 32);
        if( v24 )
          HalPutDmaAdapter(v24);
        if( (*(_DWORD *)(v23 + 28) & 4) != 0 && !*(_DWORD *)(v23 + 24) )
        {
          KsepPoolFreePaged((VOID *)v23);
          v25 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
          HIDWORD(KsepHistoryMessages[v25]) = 0;
          LODWORD(KsepHistoryMessages[v25]) = 460230;
          if( (KsepDebugFlag & 1) != 0 )
            KsepDebugPrint(
              5i64,
              "KSE: Cleaned up dangling shim object [0x%08X] (unregistered while refcount >0)\n",
              v23);
          KsepLogInfo(5, "KSE: Cleaned up dangling shim object [0x%08X] (unregistered while refcount >0)\n", v23);
        }
        v20 = (unsigned int)*v7;
        v21 = (unsigned int)(v21 + 1);
      }
      while( (unsigned int)v21 < (unsigned int)v20 );
    }
    v26 = ModuleInfo;
    KsepDbFreeDriverShims(*((_KSE_SHIM_INFO **)ModuleInfo + 4), v20);
    KsepPoolFreePaged(v26);
    v27 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
    HIDWORD(KsepHistoryMessages[v27]) = 0;
    LODWORD(KsepHistoryMessages[v27]) = 460238;
    if( (KsepDebugFlag & 1) != 0 )
      KsepDebugPrint(5i64, "KSE: Shimmed driver unload notification processed\n");
    KsepLogInfo(5, "KSE: Shimmed driver unload notification processed\n");
  }
  return 0;
}

Referenced by: