NtGetCachedSigningLevel

NTSTATUS __stdcall NtGetCachedSigningLevel(
        VOID *File,
        UINT64 *Flags,
        UINT8 *SigningLevel,
        UINT8 *Thumbprint,
        UINT64 *ThumbprintSize,
        UINT64 *ThumbprintAlgorithm){
  _ADAPTER_OBJECT *v10; 
  char PreviousMode; 
  int v12; 
  NTSTATUS CachedSigningLevel; 
  _DWORD *v15; 
  char v16; 
  size_t v17; 
  VOID *v18; 
  _DWORD *v19; 
  char SigningLevela[4]; 
  UINT64 Flagsa; 
  int v22; 
  PVOID Object; 
  int v24; 
  VOID *Address; 
  UINT64 v26; 
  _HANDLE Handle[2]; 
  UINT64 v28; 
  UINT64 v29; 
  PVOID v30; 
  char Src[64]; 

  v28 = (UINT64)Thumbprint;
  v26 = (UINT64)SigningLevel;
  Address = Flags;
  *(_QWORD *)Handle = File;
  v29 = (UINT64)ThumbprintAlgorithm;
  v10 = 0i64;
  memset(Src, 0i64, sizeof(Src));
  v22 = 0;
  Flagsa = 0x4000000000i64;
  SigningLevela[0] = 0;
  if( File && Flags && SigningLevel )
  {
    PreviousMode = KeGetCurrentThread()->PreviousMode;
    Object = 0i64;
    v12 = ObReferenceObjectByHandle(
            *(VOID **)Handle,
            1ui64,
            (_OBJECT_TYPE *)IoFileObjectType,
            PreviousMode,
            &Object,
            0i64);
    v10 = (_ADAPTER_OBJECT *)Object;
    v30 = Object;
    if( v12 >= 0 )
    {
      CachedSigningLevel = SeGetCachedSigningLevel(
                             (_FILE_OBJECT *)Object,
                             &Flagsa,
                             (UINT8 *)SigningLevela,
                             (UINT8 *)((unsigned __int64)Src & -(__int64)(Thumbprint != 0i64)),
                             (UINT64 *)(((unsigned __int64)&Flagsa + 4) & -(__int64)(Thumbprint != 0i64)),
                             (UINT64 *)((unsigned __int64)&v22 & ((unsigned __int128)-(__int128)(unsigned __int64)Thumbprint >> 64)));
      LODWORD(Object) = CachedSigningLevel;
      v12 = CachedSigningLevel;
      if( CachedSigningLevel >= 0 )
      {
        v15 = Address;
        if( PreviousMode == 1 )
        {
          ProbeForWrite((UINT64)Address, 4i64, 4i64);
          ProbeForWrite(v26, 1i64, 1i64);
        }
        v16 = Flagsa;
        *v15 = Flagsa;
        *(_BYTE *)v26 = SigningLevela[0];
        v12 = CachedSigningLevel;
        if( ThumbprintSize )
        {
          if( PreviousMode == 1 )
          {
            ProbeForWrite((UINT64)ThumbprintSize, 4i64, 4i64);
            v16 = Flagsa;
          }
          if( (v16 & 2) != 0 )
          {
            v17 = HIDWORD(Flagsa);
            if( *(_DWORD *)ThumbprintSize >= HIDWORD(Flagsa) && (v18 = (VOID *)v28) != 0i64 )
            {
              if( PreviousMode == 1 )
              {
                ProbeForWrite(v28, HIDWORD(Flagsa), 1i64);
                v17 = HIDWORD(Flagsa);
              }
              memmove(v18, Src, v17);
              v12 = (int)Object;
            }
            else
            {
              v12 = -1073741789;
              v24 = -1073741789;
            }
            *(_DWORD *)ThumbprintSize = v17;
            v19 = (_DWORD *)v29;
            if( v29 )
            {
              if( PreviousMode == 1 )
                ProbeForWrite(v29, 4i64, 4i64);
              *v19 = v22;
            }
          }
          else
          {
            *(_DWORD *)ThumbprintSize = 0;
            v12 = CachedSigningLevel;
          }
        }
      }
    }
  }
  else
  {
    v12 = -1073741811;
  }
  if( v10 )
    HalPutDmaAdapter(v10);
  return v12;
}

Referenced by: