SepRmVerifyLsaProtectionLevel

VOID __fastcall SepRmVerifyLsaProtectionLevel(_SEP_RM_LSA_CONNECTION_STATE *RmLsaState){
  WCHAR v1; 
  void *LsaProcessHandle; 
  NTSTATUS v4; 
  char v5; 
  int Value; 
  ULONG ReturnLength; 
  PVOID Object; 
  struct _UNICODE_STRING DestinationString; 
  GUID VendorGuid; 
  Value = 0;
  ReturnLength = 4;
  VendorGuid.Data1 = 2012912317;
  *(_DWORD *)&VendorGuid.Data2 = 1295123289;
  DestinationString = 0i64;
  *(_DWORD *)VendorGuid.Data4 = -198680387;
  *(_DWORD *)&VendorGuid.Data4[4] = 1266192359;
  RtlInitUnicodeString(&DestinationString, L"Kernel_Lsa_Ppl_Config", v1);
  ZwQuerySystemEnvironmentValueEx(&DestinationString, &VendorGuid, &Value, &ReturnLength, 0i64);
  if( Value == 4 )
  {
    LsaProcessHandle = RmLsaState->LsaProcessHandle;
    Object = 0i64;
    v4 = ObReferenceObjectByHandle(LsaProcessHandle, 0x2000000u, 0i64, 0, &Object, 0i64);
    if( v4 >= 0 )
    {
      v5 = *((_BYTE *)Object + 2170);
      HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      if( v5 == 65 )
        return;
      v4 = -1073741790;
    }
    KeBugCheckEx(0x29u, v4, (ULONG_PTR)"minkernel\\ntos\\se\\rmmain.c", 0x295ui64, 0i64);
  }
}

Referenced by: