ExpFirmwareAccessAppContainerCheck

BOOL __stdcall ExpFirmwareAccessAppContainerCheck(INT64 a1){
  int v1; 
  _DWORD *v3; 
  _DWORD *v4; 
  UINT64 *ReturnLength; 
  VOID **v6; 
  VOID *IsMember; 
  VOID **IdentifierAuthority_4; 
  VOID *TokenInformation_4; 
  _UNICODE_STRING SourceString; 
  _UNICODE_STRING v11; 
  _UNICODE_STRING v12; 
  __int128 Sid; 
  __int64 v14; 
  __int64 v15; 
  int v16; 
  __int16 v17; 
  __int128 v18[4]; 
  __int64 v19; 
  wchar_t v20; 
  __int128 v21[4]; 
  __int64 v22; 
  int v23; 

  TokenInformation_4 = 0i64;
  HIDWORD(IdentifierAuthority_4) = 0;
  HIDWORD(IsMember) = 0;
  v14 = 0i64;
  v16 = 7536751;
  v17 = 0;
  v12.Buffer = (wchar_t *)&v15;
  v18[1] = *(_OWORD *)L"t.firmwareRead_cw5n1h2txyewy";
  v20 = aMicrosoftFirmw_0[36];
  v18[3] = *(_OWORD *)L"w5n1h2txyewy";
  v11.Buffer = (wchar_t *)v18;
  v21[1] = *(_OWORD *)L"t.firmwareWrite_cw5n1h2txyewy";
  v23 = *(_DWORD *)L"y";
  LOWORD(IdentifierAuthority_4) = 1280;
  *(_QWORD *)&v12.Length = 917516i64;
  *(_QWORD *)&v11.Length = 4849736i64;
  v21[3] = *(_OWORD *)L"cw5n1h2txyewy";
  *(_QWORD *)&SourceString.Length = 4980810i64;
  SourceString.Buffer = (wchar_t *)v21;
  Sid = 0i64;
  v15 = 0x690062006D0073i64;
  v18[0] = *(_OWORD *)L"Microsoft.firmwareRead_cw5n1h2txyewy";
  v18[2] = *(_OWORD *)L"reRead_cw5n1h2txyewy";
  v19 = *(_QWORD *)L"yewy";
  v21[0] = *(_OWORD *)&stru_1407D9590._R15;
  v21[2] = *(_OWORD *)L"reWrite_cw5n1h2txyewy";
  v22 = *(_QWORD *)L"xyewy";
  if( !(_DWORD)a1 )
    return ExpCapabilityCheck(&v12);
  v1 = a1 - 1;
  if( v1 )
  {
    if( v1 != 1 )
      return 0;
    goto LABEL_4;
  }
  if( !(unsigned __int8)ExpCapabilityCheck(&v11) )
  {
LABEL_4:
    if( !(unsigned __int8)ExpCapabilityCheck(&SourceString) )
      return 0;
  }
  if( KeGetCurrentThread()->ApcState.Process->Protection.Level != 0x81 )
  {
    RtlRunOnceExecuteOnce(
      (_RTL_RUN_ONCE *)&WheapErrorSourceTable + 127,
      (UINT64)ExpInitExpCheckTestSigningInfo,
      0i64,
      0i64,
      ReturnLength,
      v6,
      IsMember,
      IdentifierAuthority_4);
    if( !*(&WheapDeferredInternalLogsEventLock + 2728) )
      return 0;
  }
  LOBYTE(IsMember) = 0;
  RtlInitializeSid(&Sid, (_SID_IDENTIFIER_AUTHORITY *)((char *)&IsMember + 4), 2u);
  LODWORD(v3) = RtlSubAuthoritySid((INT64)&Sid, 0i64);
  *v3 = 32;
  LODWORD(v4) = RtlSubAuthoritySid((INT64)&Sid, 1ui64);
  *v4 = 544;
  return ZwQueryInformationToken(
           0xFFFFFFFFFFFFFFFAui64,
           19i64,
           (UINT64)&TokenInformation_4,
           8ui64,
           (UINT64)&IdentifierAuthority_4 + 4) >= 0
      && HIDWORD(IdentifierAuthority_4) == 8
      && RtlCheckTokenMembershipEx(TokenInformation_4, &Sid, 1ui64, (UINT8 *)&IsMember) >= 0
      && (_BYTE)IsMember;
}

Referenced by: