KseRegisterShimEx

NTSTATUS __fastcall KseRegisterShimEx(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
  int v5; 
  int LoadedModulesList; 
  _QWORD *Paged; 
  _ETHREAD *CurrentThread; 
  __int64 v10; 
  _QWORD *v11; 
  char v12; 
  __int64 v13; 
  __int64 v15; 
  __int64 v16; 
  VOID *retaddr; 
  _RTL_PROCESS_MODULES *LoadedModules; 

  v5 = a3;
  if( !a1 )
    return -1073741811;
  if( dword_140C50324 != 2 )
    return -1073741823;
  LoadedModules = 0i64;
  LoadedModulesList = KsepGetLoadedModulesList(&LoadedModules);
  if( LoadedModulesList >= 0 )
  {
    if( KsepValidateShimProviderAndData(retaddr, LoadedModules, (_KSE_SHIM *)a1) )
    {
      Paged = KsepPoolAllocatePaged(0x28ui64);
      if( Paged )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --CurrentThread->Tcb.KernelApcDisable;
        ExAcquirePushLockExclusiveEx(&stru_140C50350, 0i64);
        if( (unsigned int)KsepIsShimRegistered((__int64)&Engine, *(_QWORD **)(a1 + 8), v10, 0i64) )
        {
          if( (_InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
            ExfTryToWakePushLock(&stru_140C50350);
          KeAbPostRelease(&stru_140C50350);
          KeLeaveCriticalRegionThread(KeGetCurrentThread());
          LoadedModulesList = -1073741771;
          v16 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
          dword_140C2A864[2 * v16] = -1073741771;
          KsepHistoryErrors[2 * v16] = 131310;
          if( (KsepDebugFlag & 2) != 0 )
            KsepDebugPrint(2i64, "KSE: Attempt to re-register shim [0x%08X]\n", **(unsigned int **)(a1 + 8));
          KsepLogError(2, "KSE: Attempt to re-register shim [0x%08X]\n", **(unsigned int **)(a1 + 8));
          KsepPoolFreePaged(Paged);
        }
        else
        {
          *((_DWORD *)Paged + 6) = 0;
          Paged[2] = a1;
          *((_DWORD *)Paged + 7) = v5;
          Paged[4] = a4;
          v11 = qword_140C50338;
          if( (_UNKNOWN *)*qword_140C50338 != &unk_140C50330 )
            __fastfail(3u);
          *Paged = &unk_140C50330;
          Paged[1] = v11;
          *v11 = Paged;
          qword_140C50338 = Paged;
          v12 = _InterlockedExchangeAdd64(&stru_140C50350._bf_0, 0xFFFFFFFFFFFFFFFFui64);
          if( (v12 & 2) != 0 && (v12 & 4) == 0 )
            ExfTryToWakePushLock(&stru_140C50350);
          KeAbPostRelease(&stru_140C50350);
          KeLeaveCriticalRegionThread(KeGetCurrentThread());
          LoadedModulesList = 0;
          *(_QWORD *)(a1 + 24) = &unk_140C50358;
          v13 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
          HIDWORD(KsepHistoryMessages[v13]) = 0;
          LODWORD(KsepHistoryMessages[v13]) = 131353;
          if( (KsepDebugFlag & 1) != 0 )
            KsepDebugPrint(2i64, "KSE: Succeeded shim [0x%08X] registration\n", **(unsigned int **)(a1 + 8));
          KsepLogInfo(2, "KSE: Succeeded shim [0x%08X] registration\n", **(unsigned int **)(a1 + 8));
        }
      }
      else
      {
        LoadedModulesList = -1073741670;
      }
    }
    else
    {
      LoadedModulesList = -1073741823;
      v15 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      dword_140C2A864[2 * v15] = -1073741823;
      KsepHistoryErrors[2 * v15] = 131277;
      if( (KsepDebugFlag & 2) != 0 )
        KsepDebugPrint(2i64, "KSE: Shim [0x%08X] is not valid\n", **(unsigned int **)(a1 + 8));
      KsepLogError(2, "KSE: Shim [0x%08X] is not valid\n", **(unsigned int **)(a1 + 8));
    }
  }
  if( LoadedModules )
    KsepPoolFreePaged(LoadedModules);
  return LoadedModulesList;
}

Referenced by: