ExpQueryElamCertInfo

NTSTATUS __stdcall ExpQueryElamCertInfo(VOID *ElamHandle){
  VOID *v1; 
  int Section; 
  UINT64 v3; 
  _ADAPTER_OBJECT *v4; 
  _LARGE_INTEGER v5; 
  VOID *PoolWithQuotaTag; 
  UINT8 v7; 
  INT64 v8; 
  const WCHAR *v9; 
  VOID **KernelHandle; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  PVOID Object; 
  _LARGE_INTEGER FileSize; 
  UINT64 ViewSize[3]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *BaseAddress; 
  VOID *SectionHandle; 
  VOID *Handle; 

  Handle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  FileSize.QuadPart = 0i64;
  ViewSize[0] = 0i64;
  SectionHandle = 0i64;
  v1 = 0i64;
  BaseAddress = 0i64;
  Section = IoConvertFileHandleToKernelHandle(ElamHandle, KeGetCurrentThread()->PreviousMode, 1ui64, 0, &Handle);
  if( Section >= 0 )
  {
    Object = 0i64;
    v3 = (UINT64)Handle;
    Section = ObReferenceObjectByHandle(Handle, 1ui64, (_OBJECT_TYPE *)IoFileObjectType, 0, &Object, 0i64);
    v4 = (_ADAPTER_OBJECT *)Object;
    if( Section >= 0 )
    {
      if( *((_BYTE *)Object + 78) || *((_BYTE *)Object + 75) )
      {
        Section = -1073741757;
      }
      else
      {
        Section = FsRtlGetFileSize((_FILE_OBJECT *)Object, &FileSize);
        if( Section >= 0 )
        {
          ObjectAttributes.Length = 48;
          ObjectAttributes.RootDirectory = 0i64;
          ObjectAttributes.Attributes = 576;
          ObjectAttributes.ObjectName = 0i64;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          LODWORD(HandleInformation) = 0x8000000;
          LODWORD(KernelHandle) = 2;
          Section = ZwCreateSection(
                      (UINT64)&SectionHandle,
                      4ui64,
                      (INT64)&ObjectAttributes,
                      0i64,
                      (INT64)KernelHandle,
                      (INT64)HandleInformation,
                      v3);
          if( Section >= 0 )
          {
            v5 = FileSize;
            ViewSize[0] = FileSize.QuadPart;
            LODWORD(Win32Protect) = 2;
            LODWORD(AllocationType) = 0;
            Section = ZwMapViewOfSection(
                        SectionHandle,
                        (VOID *)0xFFFFFFFFFFFFFFFFi64,
                        &BaseAddress,
                        0i64,
                        0i64,
                        0i64,
                        ViewSize,
                        ViewShare,
                        AllocationType,
                        Win32Protect);
            if( Section >= 0 )
            {
              if( qword_140C1D908 )
                Section = ((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD))qword_140C1D908)(
                            0i64,
                            BaseAddress,
                            (_LARGE_INTEGER)v5.QuadPart);
              else
                Section = -1073741637;
              if( Section >= 0 )
              {
                PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v5.QuadPart, 0x4D414C45ui64);
                v1 = PoolWithQuotaTag;
                ViewSize[2] = (UINT64)PoolWithQuotaTag;
                if( PoolWithQuotaTag )
                {
                  memmove(PoolWithQuotaTag, BaseAddress, v5.anonymous_0.LowPart);
                  if( qword_140C1D908 )
                    Section = ((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD))qword_140C1D908)(
                                0i64,
                                v1,
                                (_LARGE_INTEGER)v5.QuadPart);
                  else
                    Section = -1073741637;
                  if( Section >= 0 )
                  {
                    LOBYTE(v8) = 1;
                    Section = SeRegisterElamCertResources(v1, v7, v8, v9);
                    if( Section >= 0 )
                      Section = 0;
                  }
                }
                else
                {
                  Section = -1073741670;
                }
              }
            }
            else
            {
              BaseAddress = 0i64;
            }
          }
          else
          {
            SectionHandle = 0i64;
          }
        }
      }
    }
    else
    {
      v4 = 0i64;
    }
  }
  else
  {
    v3 = 0i64;
    v4 = 0i64;
  }
  if( v1 )
    ExFreePoolWithTag(v1, 0x4D414C45u);
  if( BaseAddress )
    ZwUnmapViewOfSection((VOID *)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
  if( SectionHandle )
    ZwClose((_HANDLE)SectionHandle);
  if( v4 )
    HalPutDmaAdapter(v4);
  if( v3 )
    ZwClose(v3);
  return Section;
}

Referenced by: