ExpQueryCodeIntegrityCertificateInfo

NTSTATUS __stdcall ExpQueryCodeIntegrityCertificateInfo(VOID *a1, INT64 a2){
  _ADAPTER_OBJECT *v2; 
  VOID *v3; 
  unsigned int v4; 
  int Section; 
  NTSTATUS v6; 
  _LARGE_INTEGER v7; 
  VOID **KernelHandle; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  _HANDLE Handle[2]; 
  PVOID Object; 
  _LARGE_INTEGER FileSize; 
  UINT64 ViewSize; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *BaseAddress; 
  VOID *SectionHandle; 

  FileSize.QuadPart = 0i64;
  v2 = 0i64;
  ViewSize = 0i64;
  v3 = 0i64;
  *(_QWORD *)Handle = 0i64;
  SectionHandle = 0i64;
  BaseAddress = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( (_DWORD)a2 )
  {
    if( (_DWORD)a2 == 1 )
    {
      v4 = 2;
    }
    else
    {
      if( (_DWORD)a2 != 2 )
      {
        Section = -1073741811;
        goto LABEL_22;
      }
      v4 = 3;
    }
  }
  else
  {
    v4 = 1;
  }
  Section = IoConvertFileHandleToKernelHandle(a1, KeGetCurrentThread()->PreviousMode, 1ui64, 0, (VOID **)Handle);
  if( Section >= 0 )
  {
    v3 = *(VOID **)Handle;
    Object = 0i64;
    v6 = ObReferenceObjectByHandle(*(VOID **)Handle, 1ui64, (_OBJECT_TYPE *)IoFileObjectType, 0, &Object, 0i64);
    v2 = (_ADAPTER_OBJECT *)Object;
    Section = v6;
    if( v6 >= 0 )
    {
      if( *((_BYTE *)Object + 78) || *((_BYTE *)Object + 75) )
      {
        Section = -1073741757;
      }
      else
      {
        Section = FsRtlGetFileSize((_FILE_OBJECT *)Object, &FileSize);
        if( Section >= 0 )
        {
          LODWORD(HandleInformation) = 0x8000000;
          ObjectAttributes.Length = 48;
          ObjectAttributes.RootDirectory = 0i64;
          ObjectAttributes.Attributes = 576;
          ObjectAttributes.ObjectName = 0i64;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          LODWORD(KernelHandle) = 2;
          Section = ZwCreateSection(
                      (UINT64)&SectionHandle,
                      4ui64,
                      (INT64)&ObjectAttributes,
                      0i64,
                      (INT64)KernelHandle,
                      (INT64)HandleInformation,
                      (UINT64)v3);
          if( Section >= 0 )
          {
            v7 = FileSize;
            LODWORD(Win32Protect) = 2;
            LODWORD(AllocationType) = 0;
            ViewSize = FileSize.QuadPart;
            Section = ZwMapViewOfSection(
                        SectionHandle,
                        (VOID *)0xFFFFFFFFFFFFFFFFi64,
                        &BaseAddress,
                        0i64,
                        0i64,
                        0i64,
                        &ViewSize,
                        ViewShare,
                        AllocationType,
                        Win32Protect);
            if( Section < 0 )
            {
              BaseAddress = 0i64;
              goto LABEL_24;
            }
            if( qword_140C1D908 )
              Section = ((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD))qword_140C1D908)(
                          v4,
                          BaseAddress,
                          (_LARGE_INTEGER)v7.QuadPart);
            else
              Section = -1073741637;
          }
          else
          {
            SectionHandle = 0i64;
          }
        }
      }
    }
    else
    {
      v2 = 0i64;
    }
  }
LABEL_22:
  if( BaseAddress )
    ZwUnmapViewOfSection((VOID *)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
LABEL_24:
  if( SectionHandle )
    ZwClose((_HANDLE)SectionHandle);
  if( v2 )
    HalPutDmaAdapter(v2);
  if( v3 )
    ZwClose((_HANDLE)v3);
  return Section;
}

Referenced by: