PsBlockNonCetBinaries

NTSTATUS __stdcall PsBlockNonCetBinaries(INT64 a1, UINT8 a2, UINT8 a3, UINT16 *a4){
  int v4; 
  unsigned int v6; 
  int v8; 
  int v9; 
  INT64 v10; 
  INT64 v11; 
  int v12; 
  INT64 v14; 

  v4 = *(_DWORD *)(a1 + 2172);
  v6 = a2;
  if( (v4 & 0x1000) != 0 || (v4 & 1) != 0 )
    return 0;
  v8 = *(_DWORD *)(a1 + 2516);
  v9 = v8 & 0x800000;
  if( (v8 & 0x400000) != 0 )
  {
    if( (_BYTE)v6 && a3 )
      return 0;
    v10 = a3;
    LODWORD(v14) = 1;
    v11 = v6;
    v12 = -(v9 != 0);
  }
  else
  {
    if( (v8 & 0x200000) == 0 || (_BYTE)v6 )
      return 0;
    v10 = a3;
    v12 = -(v9 != 0);
    LODWORD(v14) = 0;
    v11 = 0i64;
  }
  EtwTimLogBlockNonCetBinaries((unsigned int)(v12 + 2), a1, v11, v10, a4, v14);
  if( !v9 )
    return -1073741790;
  return 0;
}

Referenced by: