KseDriverLoadImage

__int64 __fastcall KseDriverLoadImage(__int64 a1){
  int ShimsForDriver; 
  bool v3; 
  _UNICODE_STRING TargetString; 
  _UNICODE_STRING String; 
  INT64 ShimCount; 
  INT64 Shims; 
  LODWORD(ShimCount) = 0;
  Shims = 0i64;
  *(_QWORD *)&TargetString.Length = 0i64;
  TargetString.Buffer = 0i64;
  *(_QWORD *)&String.Length = 0i64;
  String.Buffer = 0i64;
  if( !a1
    || (unsigned int)MmIsSessionAddress(*(PVOID *)(a1 + 48)) == 1
    || dword_140C50324 != 2
    || (*(_BYTE *)KseEngine & 1) != 0 )
  {
    goto LABEL_20;
  }
  ShimsForDriver = KsepStringDuplicateUnicode(&TargetString, (_UNICODE_STRING *)(a1 + 88));
  if( ShimsForDriver >= 0 )
  {
    ShimsForDriver = KsepStringDuplicateUnicode(&String, (_UNICODE_STRING *)(a1 + 72));
    if( ShimsForDriver >= 0 )
    {
      ShimsForDriver = KsepGetShimsForDriver(
                         (INT64)&TargetString,
                         (INT64)&String,
                         *(VOID **)(a1 + 48),
                         *(unsigned int *)(a1 + 64),
                         (INT64)&Shims,
                         (INT64)&ShimCount);
      if( ShimsForDriver >= 0 )
      {
        ShimsForDriver = KsepApplyShimsToDriver(a1, (__int64)&TargetString, Shims, ShimCount);
        if( ShimsForDriver >= 0 )
          KsepEvntLogShimsApplied((__int64)&TargetString, Shims, (EVENT_DESCRIPTOR *)(unsigned int)ShimCount);
      }
    }
  }
  v3 = ShimsForDriver < 0;
  if( !ShimsForDriver )
  {
    dword_140C50328 |= 0x800u;
    v3 = 0;
    qword_140C50378 = *(_QWORD *)(a1 + 48);
  }
  if( v3 )
  {
    if( ShimsForDriver == -1073740948 )
    {
      KsepHistoryMessages[((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F] = 458943i64;
      if( (KsepDebugFlag & 1) != 0 )
        KsepDebugPrint(4i64, "KSE: driver blocked from loading [%ws].\n", TargetString.Buffer);
      KsepLogInfo(4, "KSE: driver blocked from loading [%ws].\n", TargetString.Buffer);
      goto LABEL_21;
    }
LABEL_20:
    ShimsForDriver = 0;
    goto LABEL_21;
  }
  KsepHistoryMessages[((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F] = 458952i64;
  if( (KsepDebugFlag & 1) != 0 )
    KsepDebugPrint(4i64, "KSE: Applied %d shim(s) to [%ws].\n", (unsigned int)ShimCount, TargetString.Buffer);
  KsepLogInfo(4, "KSE: Applied %d shim(s) to [%ws].\n", (unsigned int)ShimCount, TargetString.Buffer);
LABEL_21:
  KsepStringFree(&TargetString);
  KsepStringFree(&String);
  return(unsigned int)ShimsForDriver;
}

Referenced by: