SeGetImageRequiredSigningLevel

NTSTATUS __stdcall SeGetImageRequiredSigningLevel(
        _FILE_OBJECT *FileObject,
        UINT64 SecureType,
        UINT8 RequestedSigningLevel,
        UINT8 ExistingSigningLevel,
        UINT8 *SigningLevel){
  int IsUntrustedObject; 
  _FILE_OBJECT *v7; 
  char v8; 
  _EPROCESS *Process; 
  INT64 v10; 
  UINT8 v11; 
  INT64 v13; 
  INT64 v14; 
  INT64 v15[3]; 

  IsUntrustedObject = 0;
  LOWORD(v15[0]) = 0;
  v7 = FileObject;
  BYTE2(v15[0]) = 0;
  if( qword_140C1D930 )
    return((__int64(__fastcall *)(_FILE_OBJECT *, UINT64, UINT8, UINT8, UINT8 *))qword_140C1D930)(
             FileObject,
             SecureType,
             RequestedSigningLevel,
             ExistingSigningLevel,
             SigningLevel);
  v8 = (char)SeILSigningPolicy;
  if( !(_BYTE)SeILSigningPolicy )
    v8 = byte_140CEC528;
  if( v8 == 2 && !RequestedSigningLevel )
  {
    *SigningLevel = 2;
    return IsUntrustedObject;
  }
  if( RequestedSigningLevel == 2 )
  {
    if( !v8 )
    {
      *SigningLevel = 0;
      return IsUntrustedObject;
    }
  }
  else if( !RequestedSigningLevel )
  {
LABEL_30:
    *SigningLevel = RequestedSigningLevel;
    return IsUntrustedObject;
  }
  if( (SecureType & 0x10) != 0 )
    goto LABEL_30;
  if( qword_140C1D900 )
  {
    LOBYTE(SecureType) = RequestedSigningLevel;
    LOBYTE(FileObject) = ExistingSigningLevel;
    if( (unsigned int)qword_140C1D900(FileObject, SecureType) )
      goto LABEL_30;
  }
  Process = KeGetCurrentThread()->ApcState.Process;
  if( (Process->Protection.Level & 7) != 0 || RequestedSigningLevel != 6 )
    goto LABEL_30;
  if( (Process->MitigationFlags & 0x800000) != 0 )
    goto LABEL_18;
  if( !qword_140C1D8F8 )
    return -1073741823;
  IsUntrustedObject = qword_140C1D8F8(v7, v15, (char *)v15 + 1, ExistingSigningLevel);
  if( IsUntrustedObject < 0 )
    return IsUntrustedObject;
  if( LOWORD(v15[0]) )
    goto LABEL_18;
  IsUntrustedObject = RtlIsUntrustedObject(0i64, v7, (UINT8 *)v15 + 2, v10, v13, v14, v15[0], v15[1]);
  if( IsUntrustedObject < 0 )
    return IsUntrustedObject;
  if( BYTE2(v15[0]) )
  {
LABEL_18:
    *SigningLevel = 6;
  }
  else if( (unsigned __int8)v8 < 2u )
  {
    *SigningLevel = 0;
  }
  else
  {
    v11 = 9;
    if( v8 != 2 )
      v11 = 6;
    *SigningLevel = v11;
  }
  return IsUntrustedObject;
}

Referenced by: