KsepDbGetDriverShims
INT64 __fastcall KsepDbGetDriverShims(INT64 a1, VOID *a2, UINT64 a3, CHAR **a4, UINT64 *a5){
CHAR *v7;
unsigned int v8;
NTSTATUS v9;
_QWORD *v10;
unsigned int v11;
unsigned int DriverShimsInternal;
__int64 v13;
INT64 v14;
UINT8 *v16;
CHAR *v17;
UINT64 v18;
UINT64 v19;
UINT64 v20;
CHAR *Buffer;
CHAR *v22;
PVOID DbHandleOut;
CHAR *v25;
int v27;
v27 = a3;
Buffer = 0i64;
v22 = 0i64;
v7 = 0i64;
v8 = 0;
v20 = 0i64;
DbHandleOut = 0i64;
if( !a1 || !a4 )
return 3221225485i64;
*a4 = 0i64;
*(_DWORD *)a5 = 0;
v9 = KseShimDatabaseOpen(&DbHandleOut);
v10 = DbHandleOut;
v11 = v9;
if( v9 >= 0 )
{
LODWORD(v18) = v27;
DriverShimsInternal = KsepDbGetDriverShimsInternal(
*(_QWORD *)DbHandleOut,
&KsepMatchMachineInfo,
a1,
a2,
v18,
&Buffer,
(UINT64 *)((char *)&v20 + 4));
v13 = HIDWORD(v20);
v11 = DriverShimsInternal;
if( (int)(DriverShimsInternal + 0x80000000) >= 0 && DriverShimsInternal != -1073741275 )
goto LABEL_9;
v14 = v10[7];
if( v14 )
{
LODWORD(v19) = v27;
v11 = KsepDbGetDriverShimsInternal(v14, &KsepMatchMachineInfo, a1, a2, v19, &v22, &v20);
if( (int)(v11 + 0x80000000) >= 0 && v11 != -1073741275 )
{
v7 = v22;
v8 = v20;
goto LABEL_9;
}
v7 = v22;
v8 = v20;
}
if( (_DWORD)v13 )
{
if( v8 )
{
KsepPoolAllocatePaged(80i64 * (v8 + (unsigned int)v13));
v25 = (CHAR *)v16;
if( !v16 )
{
v11 = -1073741801;
goto LABEL_9;
}
memmove(v16, (UINT8 *)Buffer, 80 * v13);
memmove((UINT8 *)&v25[80 * v13], (UINT8 *)v7, v8);
*a4 = v25;
*(_DWORD *)a5 = v8 + v13;
}
else
{
v17 = Buffer;
Buffer = 0i64;
*a4 = v17;
*(_DWORD *)a5 = v13;
}
}
else
{
if( !v8 )
{
v11 = -1073741275;
LABEL_9:
if( Buffer )
KsepDbFreeDriverShims(Buffer, (unsigned int)v13);
if( v7 )
KsepDbFreeDriverShims(v7, v8);
goto LABEL_13;
}
*a4 = v7;
v7 = 0i64;
*(_DWORD *)a5 = v8;
}
v11 = 0;
goto LABEL_9;
}
LABEL_13:
if( v10 )
KseShimDatabaseClose(v10);
return v11;
}Referenced by:
KsepGetShimsForDriver