SeQuerySigningPolicy

NTSTATUS __stdcall SeQuerySigningPolicy(
        VOID *ProcessToken,
        _UNICODE_STRING *ImagePath,
        UINT64 Flags,
        PS_PROTECTION RequestedProtection,
        UINT8 *ExeSigningLevel,
        UINT8 *DllSigningLevel,
        PS_PROTECTION *Protection){
  char v7; 
  unsigned int v9; 
  UINT8 *v11; 
  __int64 v12; 
  int IsMinTCB; 
  __int64 v14; 
  char v15; 
  __int64 v16; 
  __int64 v17; 
  unsigned int(__fastcall *v19)(__int64, __int64); 
  UINT8 *v20; 

  v7 = (char)SeILSigningPolicy;
  v9 = Flags;
  if( !(_BYTE)SeILSigningPolicy )
    v7 = byte_140CEC528;
  LOBYTE(v11) = v7;
  IsMinTCB = SepIsMinTCB(
               ImagePath,
               (unsigned int)Flags,
               RequestedProtection,
               v11,
               ExeSigningLevel,
               (_PS_PROTECTION *)DllSigningLevel);
  if( IsMinTCB < 0 )
  {
    LOBYTE(v20) = v7;
    IsMinTCB = SeQuerySigningPolicyWorker(
                 ProcessToken,
                 ImagePath,
                 v9,
                 RequestedProtection,
                 v20,
                 ExeSigningLevel,
                 (PS_PROTECTION *)DllSigningLevel);
    if( IsMinTCB < 0 )
      return IsMinTCB;
  }
  v14 = (Protection->Level & 7u) - 1;
  if( (Protection->Level & 7) == 1 )
  {
    *ExeSigningLevel |= 0x30u;
  }
  else if( (Protection->Level & 7) == 2 )
  {
    *ExeSigningLevel |= 0x10u;
    *DllSigningLevel |= 0x10u;
  }
  v15 = 8;
  if( (*ExeSigningLevel & 0xF) == 8 )
    return IsMinTCB;
  if( !qword_140C1D900 )
    return IsMinTCB;
  LOBYTE(v12) = 8;
  LOBYTE(v14) = *ExeSigningLevel;
  if( !(unsigned int)qword_140C1D900(v14, v12)
    || (*(&stru_140CF2E80 + 7280) & 4) == 0
    && ((*(&stru_140CF2E80 + 7280) & 2) == 0 || !(_BYTE)KdDebuggerEnabled || (_BYTE)KdDebuggerNotPresent) )
  {
    return IsMinTCB;
  }
  if( !qword_140C1D900 || (LOBYTE(v16) = 8, LOBYTE(v17) = v7, !(unsigned int)qword_140C1D900(v17, v16)) )
  {
    if( (Protection->Level & 7) != 0 )
    {
      *ExeSigningLevel = *ExeSigningLevel & 0x30 | 8;
      v19 = (unsigned int(__fastcall *)(__int64, __int64))qword_140C1D900;
      if( qword_140C1D900 )
      {
        LOBYTE(v17) = 8;
        goto LABEL_25;
      }
LABEL_26:
      *DllSigningLevel = v15 | *DllSigningLevel & 0x30;
      return IsMinTCB;
    }
  }
  v15 = v7 & 0xF;
  *ExeSigningLevel = v7 & 0xF | *ExeSigningLevel & 0x30;
  v19 = (unsigned int(__fastcall *)(__int64, __int64))qword_140C1D900;
  if( !qword_140C1D900 )
    goto LABEL_26;
  LOBYTE(v17) = v7;
LABEL_25:
  LOBYTE(v16) = *DllSigningLevel;
  if( !v19(v17, v16) )
    goto LABEL_26;
  return IsMinTCB;
}

Referenced by: