KsepLoadShimProvider
__int64 __fastcall KsepLoadShimProvider(__int64 a1){
WCHAR *v2;
NTSTATUS v3;
struct _UNICODE_STRING DriverServiceName;
DriverServiceName = 0i64;
if( !a1 )
return 3221225485i64;
if( (*(_DWORD *)(a1 + 64) & 2) == 0 )
return 3221225659i64;
v2 = *(WCHAR **)(a1 + 40);
if( !v2 )
return 3221225473i64;
v3 = KsepStringConcatenate(
&DriverServiceName,
(PWCHAR)L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\",
v2,
0i64);
if( v3 >= 0 )
{
v3 = ZwLoadDriver(&DriverServiceName);
if( v3 == -1073741554 )
v3 = 0;
}
KsepStringFree(&DriverServiceName);
return(unsigned int)v3;
}Referenced by:
KsepResolveApplicableShimsForDriver