ExpFirmwareAccessAppContainerCheck

BOOL __fastcall ExpFirmwareAccessAppContainerCheck(INT64 a1){
  __int128 *v1; 
  int v2; 
  UINT64 v3; 
  PULONG ReturnLength; 
  INT64 v6; 
  INT64 IsMember; 
  INT64 IdentifierAuthority_4; 
  VOID *TokenInformation; 
  UNICODE_STRING SourceString; 
  UNICODE_STRING v11; 
  UNICODE_STRING v12; 
  __int128 Sid; 
  __int64 v14; 
  __int64 v15; 
  int v16; 
  __int16 v17; 
  __int128 v18[4]; 
  __int64 v19; 
  wchar_t v20; 
  __int128 v21[4]; 
  __int64 v22; 
  int v23; 
  TokenInformation = 0i64;
  HIDWORD(IdentifierAuthority_4) = 0;
  HIDWORD(IsMember) = 0;
  v14 = 0i64;
  v16 = 7536751;
  v17 = 0;
  v12.Buffer = (wchar_t *)&v15;
  v18[1] = *(_OWORD *)L"t.firmwareRead_cw5n1h2txyewy";
  v20 = aMicrosoftFirmw_0[36];
  v18[3] = *(_OWORD *)L"w5n1h2txyewy";
  v11.Buffer = (wchar_t *)v18;
  v21[1] = unk_1407D96D0;
  v23 = unk_1407D9708;
  v1 = v21;
  LOWORD(IdentifierAuthority_4) = 1280;
  *(_QWORD *)&v12.Length = 917516i64;
  *(_QWORD *)&v11.Length = 4849736i64;
  v21[3] = unk_1407D96F0;
  *(_QWORD *)&SourceString.Length = 4980810i64;
  SourceString.Buffer = (wchar_t *)v21;
  Sid = 0i64;
  v15 = 0x690062006D0073i64;
  v18[0] = *(_OWORD *)L"Microsoft.firmwareRead_cw5n1h2txyewy";
  v18[2] = *(_OWORD *)L"reRead_cw5n1h2txyewy";
  v19 = *(_QWORD *)L"yewy";
  v21[0] = *(_OWORD *)&stru_1407D9590.R15;
  v21[2] = unk_1407D96E0;
  v22 = unk_1407D9700;
  if( !(_DWORD)a1 )
  {
    LODWORD(v1) = ExpCapabilityCheck(&v12);
    return(int)v1;
  }
  v2 = a1 - 1;
  if( v2 )
  {
    if( v2 != 1 )
      goto LABEL_5;
    goto LABEL_4;
  }
  if( !(unsigned __int8)ExpCapabilityCheck(&v11) )
  {
LABEL_4:
    LODWORD(v1) = ExpCapabilityCheck(&SourceString);
    if( !(_BYTE)v1 )
      goto LABEL_5;
  }
  if( *(_BYTE *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2170i64) == 0x81
    || (LODWORD(v1) = RtlRunOnceExecuteOnce(
                        &ExpCheckTestSigningInit,
                        (PRTL_RUN_ONCE_INIT_FN)ExpInitExpCheckTestSigningInfo,
                        0i64,
                        0i64),
        ExpTestSigningEnabled) )
  {
    LOBYTE(v3) = 2;
    LOBYTE(IsMember) = 0;
    RtlInitializeSid(&Sid, (SID_IDENTIFIER_AUTHORITY *)((char *)&IsMember + 4), v3);
    *RtlSubAuthoritySid(&Sid, 0i64) = 32;
    *RtlSubAuthoritySid(&Sid, 1ui64) = 544;
    LODWORD(v1) = ZwQueryInformationToken(
                    (HANDLE)0xFFFFFFFFFFFFFFFAi64,
                    TokenLinkedToken,
                    &TokenInformation,
                    8u,
                    (PULONG)&IdentifierAuthority_4 + 1);
    if( (int)v1 >= 0 && HIDWORD(IdentifierAuthority_4) == 8 )
    {
      LODWORD(v1) = RtlCheckTokenMembershipEx(
                      TokenInformation,
                      &Sid,
                      1ui64,
                      (UINT8 *)&IsMember,
                      (INT64)ReturnLength,
                      v6,
                      IsMember,
                      IdentifierAuthority_4);
      if( (int)v1 >= 0 )
      {
        if( (_BYTE)IsMember )
        {
          LOBYTE(v1) = 1;
          return(int)v1;
        }
      }
    }
  }
LABEL_5:
  LOBYTE(v1) = 0;
  return(int)v1;
}

Referenced by: