KsepResolveShimHooks

NTSTATUS __stdcall KsepResolveShimHooks(_RTL_PROCESS_MODULES *LoadedModules, _KSE_HOOK_COLLECTION *HooksCollection){
  __int64 v4; 
  _KSE_HOOK_COLLECTION *v5; 
  _KSE_HOOK_COLLECTION v6; 
  int v7; 
  int v8; 
  VOID *v9; 
  NTSTATUS result; 
  __int64 v11; 
  int v12; 
  VOID *ExportedRoutineByName; 
  VOID *BaseAddress; 

  BaseAddress = 0i64;
  if( LoadedModules && HooksCollection )
  {
    LODWORD(v4) = 0;
    v5 = HooksCollection;
    while( 1 )
    {
      v6 = *v5;
      if( *v5 == 4 )
        return 0;
      if( v6 )
      {
        v7 = v6 - 1;
        if( v7 )
        {
          v8 = v7 - 1;
          if( !v8 )
          {
            result = KsepGetModuleInfoByName(*((WCHAR **)v5 + 1), LoadedModules, &BaseAddress);
            if( result < 0 )
              return result;
            v9 = BaseAddress;
            goto LABEL_15;
          }
          if( v8 != 1 )
            return -1073741811;
          v9 = 0i64;
        }
        else
        {
          v9 = (VOID *)*((_QWORD *)LoadedModules + 40);
        }
      }
      else
      {
        v9 = (VOID *)*((_QWORD *)LoadedModules + 3);
      }
      BaseAddress = v9;
LABEL_15:
      v11 = *((_QWORD *)v5 + 2);
      v12 = 0;
      if( v11 )
      {
        while( *(_DWORD *)v11 != 2 )
        {
          if( !*(_DWORD *)v11 )
          {
            ExportedRoutineByName = RtlFindExportedRoutineByName(v9, *(INT8 **)(v11 + 8));
            if( !ExportedRoutineByName )
              return -1073741823;
            *(_QWORD *)(v11 + 24) = ExportedRoutineByName;
          }
          v11 = *((_QWORD *)v5 + 2) + 32i64 * (unsigned int)++v12;
          if( !v11 )
            break;
        }
      }
      v4 = (unsigned int)(v4 + 1);
      v5 = &HooksCollection[6 * v4];
      if( !v5 )
        return 0;
    }
  }
  return -1073741811;
}

Referenced by: