SepIsImageInMinTcbList

VOID __stdcall SepIsImageInMinTcbList(VOID *Context){
  unsigned int v1; 
  _UNICODE_STRING *v2; 
  char v3; 
  char v4; 
  _UNICODE_STRING *v5; 
  unsigned int v6; 
  unsigned int v8; 
  _DWORD *i; 
  __int64 v10; 
  __int64 *v11; 
  INT64 v12; 
  unsigned __int64 v13; 
  unsigned __int8 v14; 
  char *v15; 
  char v16; 
  char *v17; 
  char v18; 
  unsigned __int8 *v19; 
  int v20; 
  UINT64 BufferSize; 
  VOID *KeyHandle; 
  int Buffer; 
  unsigned __int8 v24; 
  char v25; 
  char *v26; 
  char *v27; 
  unsigned __int8 *v28; 

  v4 = v3;
  v5 = v2;
  v6 = v1;
  v8 = 0;
  if( v1 )
  {
    for( i = (char *)Context + 20; ; i += 6 )
    {
      v10 = v8;
      if( (unsigned __int8)RtlEqualUnicodeString(v5, (PCUNICODE_STRING)((char *)Context + 24 * v8), 1u) )
      {
        if( !*i || *i == *(&ExBootDevicesRemovedEvent + 276) )
          break;
      }
      if( ++v8 >= v6 )
        return;
    }
    v13 = 3i64 * v8;
    v14 = *((_BYTE *)Context + 24 * v8 + 18);
    if( v14 )
      goto LABEL_8;
    if( v24 )
      v14 = v24;
    if( v14 )
    {
LABEL_8:
      v15 = v26;
      v11 = &SeProtectedMapping;
      v13 = (unsigned __int64)v14 >> 4;
      *v26 = *((_BYTE *)&SeProtectedMapping + 2 * v13);
      v16 = *((_BYTE *)&SeProtectedMapping + 2 * v13 + 1);
    }
    else
    {
      v15 = v26;
      *v26 = *((_BYTE *)Context + 24 * v10 + 16);
      v16 = *((_BYTE *)Context + 24 * v10 + 17);
    }
    v17 = v27;
    v18 = v25;
    *v27 = v16;
    if( !qword_140C1D900 || (LOBYTE(v13) = *v15, LOBYTE(v11) = v18, !(unsigned int)qword_140C1D900(v13, v11)) )
      *v15 = v18;
    if( !qword_140C1D900 || (LOBYTE(v13) = *v17, LOBYTE(v11) = v18, !(unsigned int)qword_140C1D900(v13, v11)) )
      *v17 = v18;
    v19 = v28;
    if( (v14 & 7) != 1 && ((v4 & 1) != 0 || (v14 & 7) == 2) )
    {
      if( (*v17 & 0xFu) < 4 )
        *v17 = *v15;
      v14 = *v19 & 8 | v14 & 0xF2 | 2;
    }
    *v19 = v14;
    Buffer = 0;
    KeyHandle = 0i64;
    if( !*v19 && !*v17 && RtlpOpenImageFileOptionsKeyEx(v5, (INT64)v11, v12, &KeyHandle) >= 0 )
    {
      LODWORD(BufferSize) = 4;
      if( RtlQueryImageFileKeyOption(KeyHandle, (WCHAR *)L"AuditLevel", 4ui64, &Buffer, BufferSize, 0i64) >= 0 )
      {
        v20 = Buffer & 0xF;
        if( (unsigned int)(v20 - 2) <= 0xD )
        {
          *v17 = v20;
          *v19 = 8;
        }
      }
      ZwClose((_HANDLE)KeyHandle);
    }
  }
}

Referenced by: