ExpQueryCodeIntegrityCertificateInfo

INT64 __fastcall ExpQueryCodeIntegrityCertificateInfo(VOID *a1, INT64 a2){
  struct _DMA_ADAPTER *v2; 
  HANDLE FileHandle; 
  unsigned int v4; 
  NTSTATUS v5; 
  NTSTATUS v6; 
  union _LARGE_INTEGER v7; 
  PVOID *Object; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  HANDLE Handle; 
  PVOID v14; 
  union _LARGE_INTEGER FileSize; 
  ULONG_PTR ViewSize; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID BaseAddress; 
  void *SectionHandle; 
  FileSize.QuadPart = 0i64;
  v2 = 0i64;
  ViewSize = 0i64;
  FileHandle = 0i64;
  Handle = 0i64;
  SectionHandle = 0i64;
  BaseAddress = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( (_DWORD)a2 )
  {
    if( (_DWORD)a2 == 1 )
    {
      v4 = 2;
    }
    else
    {
      if( (_DWORD)a2 != 2 )
      {
        v5 = -1073741811;
        goto LABEL_22;
      }
      v4 = 3;
    }
  }
  else
  {
    v4 = 1;
  }
  v5 = IoConvertFileHandleToKernelHandle(a1, *((_BYTE *)KeGetCurrentThread() + 562), 1ui64, 0, &Handle);
  if( v5 >= 0 )
  {
    FileHandle = Handle;
    v14 = 0i64;
    v6 = ObReferenceObjectByHandle(Handle, 1u, (POBJECT_TYPE)IoFileObjectType, 0, &v14, 0i64);
    v2 = (struct _DMA_ADAPTER *)v14;
    v5 = v6;
    if( v6 >= 0 )
    {
      if( *((_BYTE *)v14 + 78) || *((_BYTE *)v14 + 75) )
      {
        v5 = -1073741757;
      }
      else
      {
        v5 = FsRtlGetFileSize((PFILE_OBJECT)v14, &FileSize);
        if( v5 >= 0 )
        {
          LODWORD(HandleInformation) = 0x8000000;
          ObjectAttributes.Length = 48;
          ObjectAttributes.RootDirectory = 0i64;
          ObjectAttributes.Attributes = 576;
          ObjectAttributes.ObjectName = 0i64;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          LODWORD(Object) = 2;
          v5 = ZwCreateSection(
                 &SectionHandle,
                 4ui64,
                 &ObjectAttributes,
                 0i64,
                 (UINT64)Object,
                 (UINT64)HandleInformation,
                 FileHandle);
          if( v5 >= 0 )
          {
            v7 = FileSize;
            LODWORD(Win32Protect) = 2;
            LODWORD(AllocationType) = 0;
            ViewSize = FileSize.QuadPart;
            v5 = ZwMapViewOfSection(
                   SectionHandle,
                   (PVOID)0xFFFFFFFFFFFFFFFFi64,
                   &BaseAddress,
                   0i64,
                   0i64,
                   0i64,
                   &ViewSize,
                   ViewShare,
                   AllocationType,
                   Win32Protect);
            if( v5 < 0 )
            {
              BaseAddress = 0i64;
              goto LABEL_24;
            }
            if( qword_140C1D908 )
              v5 = ((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD))qword_140C1D908)(
                     v4,
                     BaseAddress,
                     (union _LARGE_INTEGER)v7.QuadPart);
            else
              v5 = -1073741637;
          }
          else
          {
            SectionHandle = 0i64;
          }
        }
      }
    }
    else
    {
      v2 = 0i64;
    }
  }
LABEL_22:
  if( BaseAddress )
    ZwUnmapViewOfSection((HANDLE)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
LABEL_24:
  if( SectionHandle )
    ZwClose(SectionHandle);
  if( v2 )
    HalPutDmaAdapter(v2);
  if( FileHandle )
    ZwClose(FileHandle);
  return(unsigned int)v5;
}

Referenced by: