KsepIsModuleShimmed

INT64 __fastcall KsepIsModuleShimmed(INT64 a1, INT64 a2, _QWORD *a3){
  unsigned int v3; 
  _ETHREAD *CurrentThread; 
  _QWORD **v8; 
  _QWORD *v9; 
  _QWORD *v11; 
  v3 = 0;
  if( !a2 || !a1 || !a3 )
    return 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *a3 = 0i64;
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50350, 0i64);
  v8 = (_QWORD **)(a1 + 32);
  v9 = *v8;
  while( v9 != v8 )
  {
    v11 = v9;
    v9 = (_QWORD *)*v9;
    if( v11[2] == a2 )
    {
      *a3 = v11;
      v3 = 1;
      break;
    }
  }
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
  KeAbPostRelease(&qword_140C50350);
  KeLeaveCriticalRegion();
  return v3;
}

Referenced by: