KseUnregisterShim

NTSTATUS __fastcall KseUnregisterShim(INT64 a1){
  _ETHREAD *CurrentThread; 
  int v4; 
  __int64 v5; 
  NTSTATUS v6; 
  _DWORD *v7; 
  __int64 v8; 
  _QWORD *v9; 
  VOID **v10; 
  __int64 v11; 
  __int64 v12; 
  VOID *Buffer; 

  Buffer = 0i64;
  if( !a1 )
    return -1073741811;
  if( dword_140C50324 != 2 )
    return -1073741823;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(&stru_140C50350, 0i64);
  if( (unsigned int)KsepIsShimRegistered((__int64)&Engine, *(_QWORD **)(a1 + 8), v5, &Buffer) )
  {
    if( *((_DWORD *)Buffer + 6) )
    {
      v6 = -1073741790;
      v7 = Buffer;
      v8 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      dword_140C2A864[2 * v8] = -1073741790;
      KsepHistoryErrors[2 * v8] = 131453;
      if( (KsepDebugFlag & 2) != 0 )
        KsepDebugPrint(
          3i64,
          "KSE: Ending shim [0x%08X] unregistration. Shim object [0x%08X] ref count is not 0.\n",
          **(unsigned int **)(a1 + 8),
          v7);
      KsepLogError(
        3,
        "KSE: Ending shim [0x%08X] unregistration. Shim object [0x%08X] ref count is not 0.\n",
        **(unsigned int **)(a1 + 8),
        v7);
      v7[7] |= 4u;
    }
    else
    {
      v9 = *(_QWORD **)Buffer;
      if( *(VOID **)(*(_QWORD *)Buffer + 8i64) != Buffer || (v10 = (VOID **)*((_QWORD *)Buffer + 1), *v10 != Buffer) )
        __fastfail(3u);
      *v10 = v9;
      v9[1] = v10;
      v4 = 1;
      v11 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
      HIDWORD(KsepHistoryMessages[v11]) = 0;
      LODWORD(KsepHistoryMessages[v11]) = 131470;
      if( (KsepDebugFlag & 1) != 0 )
        KsepDebugPrint(3i64, "KSE: Succeeded shim [0x%08X] unregistration.\n", **(unsigned int **)(a1 + 8));
      KsepLogInfo(3, "KSE: Succeeded shim [0x%08X] unregistration.\n", **(unsigned int **)(a1 + 8));
      v6 = 0;
    }
  }
  else
  {
    v6 = -1073741772;
    v12 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    dword_140C2A864[2 * v12] = -1073741772;
    KsepHistoryErrors[2 * v12] = 131482;
    if( (KsepDebugFlag & 2) != 0 )
      KsepDebugPrint(3i64, "KSE: Failed shim [0x%08X] unregistration. Shim not found.\n", **(unsigned int **)(a1 + 8));
    KsepLogError(3, "KSE: Failed shim [0x%08X] unregistration. Shim not found.\n", **(unsigned int **)(a1 + 8));
  }
  if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&stru_140C50350);
  KeAbPostRelease(&stru_140C50350);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( v4 )
    KsepPoolFreePaged(Buffer);
  return v6;
}

Referenced by: