MiAllowImageMap

NTSTATUS __stdcall MiAllowImageMap(_EPROCESS *Process, _SECTION *Section){
  _LARGE_INTEGER *v2; 
  __int64 v3; 
  unsigned int MitigationFlags; 
  __int64 v5; 
  _LARGE_INTEGER *v6; 
  int v8; 
  __int64 *v9; 
  _DWORD *v11; 
  UINT8 v12; 
  _FILE_OBJECT *v13; 
  int v14; 
  unsigned int v15; 
  int ObjectSecurity; 
  int v17; 
  int v18; 
  _FILE_OBJECT *v19; 
  VOID *v20; 
  PVOID SecurityDescriptor; 
  UINT8 MemoryAllocated; 

  MitigationFlags = Process->MitigationFlags;
  SecurityDescriptor = 0i64;
  v5 = v3;
  v6 = v2;
  v8 = MitigationFlags & 0x80000;
  if( ((MitigationFlags & 0x80000) != 0 || (MitigationFlags & 0x100000) != 0)
    && ((__int64)Section->u1.ControlArea & 3) != 0 )
  {
    v9 = MITIGATION_AUDIT_PROHIBIT_REMOTE_IMAGE_MAP;
    if( v8 )
      v9 = MITIGATION_ENFORCE_PROHIBIT_REMOTE_IMAGE_MAP;
    EtwpTimLogMitigationForProcess(1, (v8 != 0) + 1, (const _EVENT_DESCRIPTOR *)v9, Process);
    if( v8 )
      return -1073741790;
  }
  if( !*(_BYTE *)(v5 + 50) )
    goto LABEL_19;
  LODWORD(v11) = MiGetControlAreaLoadConfig(v6);
  if( (Process->MitigationFlags & 4) != 0 && (!v11 || (*v11 & 1) == 0) )
    return -1073740282;
  if( (Process->MitigationFlags2 & 0x200000) != 0 )
  {
    v12 = 0;
    if( v11 && (*(_BYTE *)v11 & 0x40) != 0 )
      v12 = 1;
    v13 = MiReferenceControlAreaFile((_CONTROL_AREA *)v6);
    v14 = PsBlockNonCetBinaries(
            (INT64)Process,
            *(_BYTE *)(*(_QWORD *)(v6->QuadPart + 56) + 76i64) & 1,
            v12,
            &v13->FileName.Length);
    MiDereferenceControlAreaFile((_CONTROL_AREA *)v6, v13);
    if( v14 < 0 )
      return v14;
  }
LABEL_19:
  v15 = MitigationFlags;
  ObjectSecurity = 0;
  v17 = MitigationFlags & 0x400000;
  v18 = v15 & 0x200000;
  if( v18 || v17 )
  {
    MemoryAllocated = 0;
    v19 = MiReferenceControlAreaFile((_CONTROL_AREA *)v6);
    ObjectSecurity = ObpGetObjectSecurity(v19, &SecurityDescriptor, &MemoryAllocated, 0);
    if( ObjectSecurity < 0 )
    {
      ObjectSecurity = -1073741790;
    }
    else
    {
      v20 = SecurityDescriptor;
      if( (unsigned int)SeQueryMandatoryLabel(SecurityDescriptor) <= 0x1000 && !SeGetTrustLabelAce(v20) )
        ObjectSecurity = -1073741790;
      ObReleaseObjectSecurity(v20, MemoryAllocated);
    }
    if( ObjectSecurity == -1073741790 )
    {
      EtwTimLogProhibitLowILImageMap((unsigned int)(v18 != 0) + 1, Process, &v19->FileName.Length);
      if( !v18 )
        ObjectSecurity = 0;
    }
    MiDereferenceControlAreaFile((_CONTROL_AREA *)v6, v19);
  }
  return ObjectSecurity;
}

Referenced by: