KsepValidateShimProviderAndData
NTSTATUS __stdcall KsepValidateShimProviderAndData(
VOID *CallerAddress,
_RTL_PROCESS_MODULES *LoadedModules,
_KSE_SHIM *ShimInformation){
__int64 v4;
__int64 v5;
__int64 v6;
__int64 v7;
__int64 v8;
int v9;
unsigned __int64 v10;
UINT64 v12;
unsigned __int64 v13;
v13 = 0i64;
LODWORD(v12) = 0;
if( !CallerAddress )
return 0;
if( !ShimInformation )
return 0;
if( KsepGetModuleInfoByAddress(CallerAddress, LoadedModules, (VOID **)&v13, &v12) < 0 )
return 0;
v4 = *((_QWORD *)ShimInformation + 6);
v5 = v4;
if( !v4 )
return 0;
LODWORD(v6) = 0;
do
{
if( *(_DWORD *)v5 == 4 )
break;
v7 = *(_QWORD *)(v5 + 16);
v8 = v7;
if( !v7 )
return 0;
v9 = 0;
do
{
if( *(_DWORD *)v8 == 2 )
break;
v10 = *(_QWORD *)(v8 + 16);
if( !v10 || v10 < v13 && v10 >= v13 + (unsigned int)v12 )
return 0;
v8 = v7 + 32i64 * (unsigned int)++v9;
}
while( v8 );
v6 = (unsigned int)(v6 + 1);
v5 = v4 + 24 * v6;
}
while( v5 );
return 1;
}Referenced by:
KseRegisterShimEx