KsepIsShimRegistered
INT64 __fastcall KsepIsShimRegistered(INT64 a1, _QWORD *a2, INT64 a3, _QWORD *a4){
unsigned int v4;
INT64 v7;
_QWORD *v8;
_QWORD *v9;
_QWORD *v10;
__int64 v11;
v4 = 0;
if( !a2 || !a1 )
return 0i64;
v7 = a1 + 16;
v8 = *(_QWORD **)(a1 + 16);
while( v8 != (_QWORD *)v7 )
{
v9 = v8;
v8 = (_QWORD *)*v8;
if( (*((_DWORD *)v9 + 7) & 4) == 0 )
{
v10 = *(_QWORD **)(v9[2] + 8i64);
v11 = *v10 - *a2;
if( *v10 == *a2 )
v11 = v10[1] - a2[1];
if( !v11 )
{
if( a4 )
*a4 = v9;
return 1;
}
}
}
return v4;
}Referenced by:
KseRegisterShimEx
KseUnregisterShim
KsepResolveApplicableShimsForDriver