KseDriverUnloadImage

__int64 __fastcall KseDriverUnloadImage(__int64 a1){
  void *v2; 
  _ETHREAD *CurrentThread; 
  _QWORD *v5; 
  __int64 v6; 
  unsigned int *v7; 
  int v8; 
  __int64 v9; 
  void(__fastcall *v10)(_QWORD); 
  __int64 v11; 
  __int64 *v12; 
  __int64 v13; 
  int v14; 
  int v15; 
  __int64 *v16; 
  __int64 **v17; 
  __int64 v18; 
  _QWORD *v19; 
  UINT64 v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  struct _DMA_ADAPTER *v24; 
  __int64 v25; 
  void *v26; 
  __int64 v27; 
  __int64 a3; 
  a3 = 0i64;
  if( !a1 )
    return 3221225485i64;
  if( dword_140C50324 != 2 )
    return 3221225659i64;
  if( (*(_BYTE *)KseEngine & 1) != 0 )
    return 3221225659i64;
  v2 = *(void **)(a1 + 48);
  if( (unsigned int)MmIsSessionAddress(v2) == 1 )
    return 3221225659i64;
  if( (unsigned int)KsepIsModuleShimmed((INT64)KseEngine, (INT64)v2, &a3) && a3 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50350, 0i64);
    v5 = (_QWORD *)a3;
    v6 = 0i64;
    v7 = (unsigned int *)(a3 + 24);
    v8 = *(_DWORD *)(a3 + 24);
    if( v8 )
    {
      do
      {
        v9 = *(_QWORD *)(v5[4] + 80 * v6 + 72);
        if( (*(_DWORD *)(v9 + 28) & 4) == 0 )
        {
          v10 = *(void(__fastcall **)(_QWORD))(*(_QWORD *)(v9 + 16) + 32i64);
          if( v10 )
            v10(*(_QWORD *)(a1 + 48));
        }
        v8 = *v7;
        v6 = (unsigned int)(v6 + 1);
      }
      while( (unsigned int)v6 < *v7 );
    }
    v11 = 0i64;
    if( v8 )
    {
      do
      {
        v12 = *(__int64 **)(v5[4] + 80 * v11 + 72);
        if( !*((_DWORD *)v12 + 6) )
        {
          v13 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
          dword_140C2A864[2 * v13] = -1073740768;
          KsepHistoryErrors[2 * v13] = 460173;
          if( (KsepDebugFlag & 4) != 0 )
            RtlAssert("RegisteredShim->RefCount > 0", "minkernel\\ntos\\kshim\\kseloader.c", 0x58Du, 0i64);
        }
        v14 = *((_DWORD *)v12 + 7);
        v15 = *((_DWORD *)v12 + 6) - 1;
        *((_DWORD *)v12 + 6) = v15;
        if( (v14 & 4) != 0 && !v15 )
        {
          v16 = (__int64 *)*v12;
          if( *(__int64 **)(*v12 + 8) != v12 )
            goto LABEL_43;
          v17 = (__int64 **)v12[1];
          if( *v17 != v12 )
            goto LABEL_43;
          *v17 = v16;
          v16[1] = (__int64)v17;
        }
        v11 = (unsigned int)(v11 + 1);
      }
      while( (unsigned int)v11 < *v7 );
      v5 = (_QWORD *)a3;
    }
    v18 = *v5;
    if( *(_QWORD **)(*v5 + 8i64) != v5 || (v19 = (_QWORD *)v5[1], (_QWORD *)*v19 != v5) )
LABEL_43:
      __fastfail(3u);
    *v19 = v18;
    *(_QWORD *)(v18 + 8) = v19;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
    KeAbPostRelease(&qword_140C50350);
    KeLeaveCriticalRegion();
    v20 = *v7;
    v21 = 0i64;
    if( (_DWORD)v20 )
    {
      v22 = a3;
      do
      {
        v23 = *(_QWORD *)(*(_QWORD *)(v22 + 32) + 80 * v21 + 72);
        v24 = *(struct _DMA_ADAPTER **)(v23 + 32);
        if( v24 )
          HalPutDmaAdapter(v24);
        if( (*(_DWORD *)(v23 + 28) & 4) != 0 && !*(_DWORD *)(v23 + 24) )
        {
          KsepPoolFreePaged((PVOID)v23);
          v25 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
          HIDWORD(KsepHistoryMessages[v25]) = 0;
          LODWORD(KsepHistoryMessages[v25]) = 460230;
          if( (KsepDebugFlag & 1) != 0 )
            KsepDebugPrint(
              5i64,
              "KSE: Cleaned up dangling shim object [0x%08X] (unregistered while refcount >0)\n",
              v23);
          KsepLogInfo(5, "KSE: Cleaned up dangling shim object [0x%08X] (unregistered while refcount >0)\n", v23);
        }
        v20 = *v7;
        v21 = (unsigned int)(v21 + 1);
      }
      while( (unsigned int)v21 < (unsigned int)v20 );
    }
    v26 = (void *)a3;
    KsepDbFreeDriverShims(*(CHAR **)(a3 + 32), v20);
    KsepPoolFreePaged(v26);
    v27 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
    HIDWORD(KsepHistoryMessages[v27]) = 0;
    LODWORD(KsepHistoryMessages[v27]) = 460238;
    if( (KsepDebugFlag & 1) != 0 )
      KsepDebugPrint(5i64, "KSE: Shimmed driver unload notification processed\n");
    KsepLogInfo(5, "KSE: Shimmed driver unload notification processed\n");
  }
  return 0i64;
}

Referenced by: