KseRegisterShimEx

__int64 __fastcall KseRegisterShimEx(__int64 a1, __int64 a2, int a3, __int64 a4){
  NTSTATUS LoadedModulesList; 
  _QWORD *v8; 
  _QWORD *v9; 
  _ETHREAD *CurrentThread; 
  INT64 v11; 
  _QWORD *v12; 
  char v13; 
  __int64 v14; 
  __int64 v16; 
  __int64 v17; 
  UINT64 retaddr; 
  PVOID Buffer; 
  if( !a1 )
    return 3221225485i64;
  if( dword_140C50324 != 2 )
    return 3221225473i64;
  Buffer = 0i64;
  LoadedModulesList = KsepGetLoadedModulesList((_RTL_PROCESS_MODULES **)&Buffer);
  if( LoadedModulesList >= 0 )
  {
    if( (unsigned int)KsepValidateShimProviderAndData(retaddr, (UINT64 *)Buffer, a1) )
    {
      KsepPoolAllocatePaged(0x28ui64);
      v9 = v8;
      if( v8 )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)CurrentThread + 242);
        ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50350, 0i64);
        if( (unsigned int)KsepIsShimRegistered((INT64)KseEngine, *(_QWORD **)(a1 + 8), v11, 0i64) )
        {
          if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
            ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
          KeAbPostRelease(&qword_140C50350);
          KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
          LoadedModulesList = -1073741771;
          v17 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
          dword_140C2A864[2 * v17] = -1073741771;
          KsepHistoryErrors[2 * v17] = 131310;
          if( (KsepDebugFlag & 2) != 0 )
            KsepDebugPrint(2i64, "KSE: Attempt to re-register shim [0x%08X]\n", **(unsigned int **)(a1 + 8));
          KsepLogError(2, "KSE: Attempt to re-register shim [0x%08X]\n", **(unsigned int **)(a1 + 8));
          KsepPoolFreePaged(v9);
        }
        else
        {
          *((_DWORD *)v9 + 6) = 0;
          v9[2] = a1;
          *((_DWORD *)v9 + 7) = a3;
          v9[4] = a4;
          v12 = (_QWORD *)qword_140C50338;
          if( *(__int64 **)qword_140C50338 != &qword_140C50330 )
            __fastfail(3u);
          *v9 = &qword_140C50330;
          v9[1] = v12;
          *v12 = v9;
          qword_140C50338 = (__int64)v9;
          v13 = _InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64);
          if( (v13 & 2) != 0 && (v13 & 4) == 0 )
            ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
          KeAbPostRelease(&qword_140C50350);
          KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
          LoadedModulesList = 0;
          *(_QWORD *)(a1 + 24) = qword_140C50358;
          v14 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
          HIDWORD(KsepHistoryMessages[v14]) = 0;
          LODWORD(KsepHistoryMessages[v14]) = 131353;
          if( (KsepDebugFlag & 1) != 0 )
            KsepDebugPrint(2i64, "KSE: Succeeded shim [0x%08X] registration\n", **(unsigned int **)(a1 + 8));
          KsepLogInfo(2, "KSE: Succeeded shim [0x%08X] registration\n", **(unsigned int **)(a1 + 8));
        }
      }
      else
      {
        LoadedModulesList = -1073741670;
      }
    }
    else
    {
      LoadedModulesList = -1073741823;
      v16 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      dword_140C2A864[2 * v16] = -1073741823;
      KsepHistoryErrors[2 * v16] = 131277;
      if( (KsepDebugFlag & 2) != 0 )
        KsepDebugPrint(2i64, "KSE: Shim [0x%08X] is not valid\n", **(unsigned int **)(a1 + 8));
      KsepLogError(2, "KSE: Shim [0x%08X] is not valid\n", **(unsigned int **)(a1 + 8));
    }
  }
  if( Buffer )
    KsepPoolFreePaged(Buffer);
  return(unsigned int)LoadedModulesList;
}

Referenced by: