MiValidateExistingImage

INT64 __fastcall MiValidateExistingImage(UINT64 *a1){
  INT64 v1; 
  CHAR v2; 
  CHAR v3; 
  bool v4; 
  INT64 result; 
  INT64 v7; 
  __int64 v8; 
  __int64 v9; 
  int v10; 
  __int64 v11; 
  unsigned int v12; 
  __int64 v13; 
  int v14; 
  UINT8 v15; 
  UINT8 v16; 
  int v17; 
  unsigned int v18; 
  int v19; 
  int v20; 
  unsigned __int8 v21; 
  int v22; 
  INT64 v23; 
  INT64 v24; 
  UINT8 SigningLevel; 
  INT64 v26; 
  _FILE_OBJECT *FileObject; 
  v1 = a1[8];
  v2 = 0;
  LODWORD(v26) = 0;
  v3 = 0;
  v4 = 0;
  FileObject = (_FILE_OBJECT *)a1[7];
  if( (*(_DWORD *)(v1 + 56) & 0x800) != 0 && (*(_DWORD *)a1 & 0x80000) != 0 )
  {
    dword_140C4C958 = 12;
    return 3221226547i64;
  }
  if( (*(_DWORD *)a1 & 0x40) != 0 )
    v7 = 2i64;
  else
    v7 = (*(_DWORD *)a1 & 0x20) != 0;
  result = MiRelocateImageAgain(v1, v7);
  if( (int)result < 0 )
  {
    dword_140C4C958 = 13;
    return result;
  }
  v8 = *(unsigned int *)a1;
  v9 = 6i64;
  if( (v8 & 0x100) != 0 )
  {
    v10 = 4;
  }
  else if( (v8 & 0x20) != 0 )
  {
    v10 = 1;
  }
  else if( (v8 & 0x10) != 0 )
  {
    v10 = (*(_DWORD *)a1 & 0x1000) != 0 ? 8 : 2;
  }
  else
  {
    v10 = 0;
  }
  v11 = *(_QWORD *)v1;
  v12 = v10 | 0x10;
  if( (v8 & 0x800) == 0 )
    v12 = v10;
  v13 = (unsigned int)v8;
  if( (v8 & 0x400) != 0 && (v8 & 0x10) == 0 )
  {
    v14 = *(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2512i64);
    v15 = *((_BYTE *)a1 + 24);
    v16 = *(_BYTE *)(v11 + 15) >> 4;
    SigningLevel = 0;
    result = SeGetImageRequiredSigningLevel(FileObject, v12, v15, v16, &SigningLevel);
    if( (int)result < 0 )
    {
      dword_140C4C958 = 14;
      return result;
    }
    v13 = *(unsigned int *)a1;
    if( (v13 & 0x800) == 0 )
    {
      if( *((_BYTE *)a1 + 24) )
      {
        v17 = v26;
        v8 = 1i64;
        if( (v14 & 0x800000) != 0 )
          v17 = 1;
        LODWORD(v26) = v17;
      }
      if( (v14 & 0x1000000) != 0 )
      {
        v2 = 8;
      }
      else
      {
        v2 = 0;
        if( (v14 & 0x2000000) != 0 )
          v2 = 6;
      }
    }
    *((_BYTE *)a1 + 24) = SigningLevel;
  }
  if( (v13 & 0x80000) != 0 )
  {
    v12 |= 0x40000000u;
    if( !*((_BYTE *)a1 + 24) )
      *((_BYTE *)a1 + 24) = 4;
  }
  v18 = v12 | 0x20000000;
  if( (v13 & 0x400000) == 0 )
    v18 = v12;
  if( (v13 & 0x400) != 0 )
  {
    if( (v13 & 0x10) != 0 )
      goto LABEL_47;
    v13 = *(unsigned __int8 *)(v11 + 15);
    LOBYTE(v8) = *((_BYTE *)a1 + 24);
    if( qword_140C1D960 )
    {
      LOBYTE(v9) = (unsigned __int8)v13 >> 4;
      v19 = ((__int64(__fastcall *)(_QWORD, __int64, __int64, _QWORD))qword_140C1D960)(
              v18,
              v8,
              v9,
              ((unsigned int)v13 >> 1) & 7);
      LOBYTE(v8) = *((_BYTE *)a1 + 24);
      LOBYTE(v13) = *(_BYTE *)(v11 + 15);
      if( v19 )
        goto LABEL_47;
    }
    if( !qword_140C1D900
      || (LOBYTE(v13) = (unsigned __int8)v13 >> 4, v20 = qword_140C1D900(v13, v8), v21 = *(_BYTE *)(v11 + 15), !v20)
      || (v18 & 0x40000000) != 0 && (*(_DWORD *)(v1 + 92) & 0xC0000) != 0x80000
      || (v21 & 0xF0) == 0 && *(char *)(*(_QWORD *)(v11 + 56) + 46i64) < 0 )
    {
LABEL_47:
      v21 = *(_BYTE *)(v11 + 15);
      v3 = 1;
    }
    v22 = (int)qword_140C1D900;
    if( qword_140C1D900 )
    {
      LOBYTE(v8) = v2;
      LOBYTE(v13) = v21 >> 4;
      v22 = qword_140C1D900(v13, v8);
    }
    v4 = v22 == 0;
  }
  LODWORD(v24) = v26;
  LODWORD(v23) = v18;
  result = MiValidateSectionSigningPolicy(
             1ui64,
             (UINT64)FileObject,
             v1,
             *((unsigned int *)a1 + 42),
             a1[20],
             v23,
             v3,
             v4,
             v24,
             *((_BYTE *)a1 + 24),
             v2);
  if( (int)result < 0 )
    dword_140C4C958 = 15;
  return result;
}

Referenced by: