KseUnregisterShim

INT64 __fastcall KseUnregisterShim(INT64 a1){
  _ETHREAD *CurrentThread; 
  int v4; 
  INT64 v5; 
  unsigned int v6; 
  __int64 *v7; 
  __int64 v8; 
  __int64 *v9; 
  __int64 **v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 *a4; 
  a4 = 0i64;
  if( !a1 )
    return 3221225485i64;
  if( dword_140C50324 != 2 )
    return 3221225473i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0;
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50350, 0i64);
  if( (unsigned int)KsepIsShimRegistered((INT64)KseEngine, *(_QWORD **)(a1 + 8), v5, &a4) )
  {
    if( *((_DWORD *)a4 + 6) )
    {
      v6 = -1073741790;
      v7 = a4;
      v8 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      dword_140C2A864[2 * v8] = -1073741790;
      KsepHistoryErrors[2 * v8] = 131453;
      if( (KsepDebugFlag & 2) != 0 )
        KsepDebugPrint(
          3i64,
          "KSE: Ending shim [0x%08X] unregistration. Shim object [0x%08X] ref count is not 0.\n",
          **(unsigned int **)(a1 + 8),
          v7);
      KsepLogError(
        3,
        "KSE: Ending shim [0x%08X] unregistration. Shim object [0x%08X] ref count is not 0.\n",
        **(unsigned int **)(a1 + 8),
        v7);
      *((_DWORD *)v7 + 7) |= 4u;
    }
    else
    {
      v9 = (__int64 *)*a4;
      if( *(__int64 **)(*a4 + 8) != a4 || (v10 = (__int64 **)a4[1], *v10 != a4) )
        __fastfail(3u);
      *v10 = v9;
      v9[1] = (__int64)v10;
      v4 = 1;
      v11 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
      HIDWORD(KsepHistoryMessages[v11]) = 0;
      LODWORD(KsepHistoryMessages[v11]) = 131470;
      if( (KsepDebugFlag & 1) != 0 )
        KsepDebugPrint(3i64, "KSE: Succeeded shim [0x%08X] unregistration.\n", **(unsigned int **)(a1 + 8));
      KsepLogInfo(3, "KSE: Succeeded shim [0x%08X] unregistration.\n", **(unsigned int **)(a1 + 8));
      v6 = 0;
    }
  }
  else
  {
    v6 = -1073741772;
    v12 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    dword_140C2A864[2 * v12] = -1073741772;
    KsepHistoryErrors[2 * v12] = 131482;
    if( (KsepDebugFlag & 2) != 0 )
      KsepDebugPrint(3i64, "KSE: Failed shim [0x%08X] unregistration. Shim not found.\n", **(unsigned int **)(a1 + 8));
    KsepLogError(3, "KSE: Failed shim [0x%08X] unregistration. Shim not found.\n", **(unsigned int **)(a1 + 8));
  }
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50350, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&qword_140C50350);
  KeAbPostRelease(&qword_140C50350);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( v4 )
    KsepPoolFreePaged(a4);
  return v6;
}

Referenced by: