NtSetCachedSigningLevel2

__int64 __fastcall NtSetCachedSigningLevel2(
        __int16 a1,
        char a2,
        const VOID *a3,
        unsigned int a4,
        __int64 a5,
        unsigned __int64 a6){
  __int64 v6; 
  char *v7; 
  __int16 v8; 
  VOID **PoolWithTag; 
  char v10; 
  char PreviousMode; 
  NTSTATUS v12; 
  __int64 v14; 
  unsigned __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  ULONG v18; 
  __int64 v19; 
  _EPROCESS *Process; 
  _EPROCESS *v21; 
  char v22; 
  _UNICODE_STRING *CapturedArray[10]; 

  v6 = a4;
  v7 = (char *)a3;
  v8 = a1;
  PoolWithTag = 0i64;
  v10 = 0;
  CapturedArray[0] = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( !qword_140C1D8C8 )
  {
    v12 = -1073741823;
    goto LABEL_10;
  }
  if( (a2 & 0x30) != 0 )
    goto LABEL_43;
  if( a4 - 1 > 0xFFF )
    goto LABEL_57;
  if( (a1 & 6) == 0 && a2 )
  {
LABEL_43:
    v12 = -1073741584;
    goto LABEL_10;
  }
  if( (a1 & 3) == 3 )
  {
LABEL_6:
    v12 = -1073741585;
    goto LABEL_10;
  }
  if( PreviousMode == 1 )
  {
    if( (a1 & 2) != 0 )
      goto LABEL_6;
    v8 = a1 | 1;
    if( (a1 & 4) == 0 )
    {
      Process = KeGetCurrentThread()->ApcState.Process;
      v21 = Process;
      if( (Process->Protection.Level & 7) != 1 )
      {
        v12 = -1073741790;
        goto LABEL_10;
      }
      v10 = Process->SignatureLevel & 0xF;
      v22 = Process->SectionSignatureLevel & 0xF;
      if( !qword_140C1D900
        || (LOBYTE(Process) = Process->SignatureLevel & 0xF,
            LOBYTE(v21) = v22,
            !(unsigned int)qword_140C1D900(v21, Process)) )
      {
        v10 = v22;
      }
      v7 = (char *)a3;
    }
  }
  else if( (a1 & 1) != 0 )
  {
    v10 = 15;
  }
  else
  {
    if( (a1 & 2) == 0 )
      goto LABEL_6;
    v10 = 8;
  }
  v14 = 8 * v6;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v14, 1668499779i64);
  CapturedArray[2] = (_UNICODE_STRING *)PoolWithTag;
  if( !PoolWithTag )
  {
    v12 = -1073741670;
    goto LABEL_10;
  }
  if( PreviousMode == 1 )
  {
    if( v14 )
    {
      if( ((unsigned __int8)v7 & 7) != 0 )
        ExRaiseDatatypeMisalignment();
      if( (unsigned __int64)&v7[v14] > 0x7FFFFFFF0000i64 || &v7[v14] < v7 )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    v15 = a6;
    if( a6 )
    {
      if( (a6 & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      if( a6 + 24 > 0x7FFFFFFF0000i64 || a6 + 24 < a6 )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    v15 = a6;
  }
  memmove(PoolWithTag, a3, v14);
  if( !v15 )
    goto LABEL_40;
  if( *(_DWORD *)v15 < 0x18u )
  {
    v12 = -1073741580;
    goto LABEL_10;
  }
  if( !*(_WORD *)(v15 + 8)
    || (v12 = SepCaptureUnicodeStringArray(
                (const _UNICODE_STRING *)(v15 + 8),
                1ui64,
                PreviousMode,
                (const _UNICODE_STRING **)CapturedArray),
        v12 >= 0)
    && (v12 = RtlUnicodeStringValidateEx(CapturedArray[0], v18), v12 >= 0) )
  {
LABEL_40:
    v19 = a4;
    if( (v8 & 6) == 0 )
    {
LABEL_9:
      LOBYTE(v17) = v10;
      LOBYTE(v16) = a2;
      LOBYTE(v19) = PreviousMode;
      v12 = ((__int64(__fastcall *)(_QWORD, __int64, __int64, __int64, VOID **, unsigned int, __int64, _UNICODE_STRING *))qword_140C1D8C8)(
              v8 & 0x807,
              v19,
              v16,
              v17,
              PoolWithTag,
              a4,
              a5,
              CapturedArray[0]);
      goto LABEL_10;
    }
    if( a4 == 1 )
    {
      if( (VOID *)a5 != *PoolWithTag )
      {
        v12 = -1073741581;
        goto LABEL_10;
      }
      goto LABEL_9;
    }
LABEL_57:
    v12 = -1073741582;
  }
LABEL_10:
  if( PreviousMode == 1 && CapturedArray[0] )
    ExFreePoolWithTag(CapturedArray[0], 0);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x63734943u);
  return(unsigned int)v12;
}

Referenced by: