MiAllowImageMap

INT64 __fastcall MiAllowImageMap(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
  int v4; 
  int v8; 
  const EVENT_DESCRIPTOR *v9; 
  _DWORD *v11; 
  UINT8 v12; 
  _FILE_OBJECT *v13; 
  int v14; 
  int v15; 
  NTSTATUS ObjectSecurity; 
  int v17; 
  int v18; 
  _FILE_OBJECT *v19; 
  PSECURITY_DESCRIPTOR v20; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  BOOLEAN MemoryAllocated; 
  v4 = *(_DWORD *)(a1 + 2512);
  SecurityDescriptor = 0i64;
  v8 = v4 & 0x80000;
  if( ((v4 & 0x80000) != 0 || (v4 & 0x100000) != 0) && (*(_BYTE *)(a2 + 40) & 3) != 0 )
  {
    v9 = (const EVENT_DESCRIPTOR *)MITIGATION_AUDIT_PROHIBIT_REMOTE_IMAGE_MAP;
    if( v8 )
      v9 = &MITIGATION_ENFORCE_PROHIBIT_REMOTE_IMAGE_MAP;
    EtwpTimLogMitigationForProcess(1i64, (unsigned int)(v8 != 0) + 1, v9, a1);
    if( v8 )
      return 3221225506i64;
  }
  if( !*(_BYTE *)(a4 + 50) )
    goto LABEL_19;
  LODWORD(v11) = MiGetControlAreaLoadConfig((LARGE_INTEGER *)a3);
  if( (*(_DWORD *)(a1 + 2512) & 4) != 0 && (!v11 || (*v11 & 1) == 0) )
    return 3221227014i64;
  if( (*(_DWORD *)(a1 + 2516) & 0x200000) != 0 )
  {
    v12 = 0;
    if( v11 && (*(_BYTE *)v11 & 0x40) != 0 )
      v12 = 1;
    v13 = MiReferenceControlAreaFile((_CONTROL_AREA *)a3);
    v14 = PsBlockNonCetBinaries(
            a1,
            *(_BYTE *)(*(_QWORD *)(*(_QWORD *)a3 + 56i64) + 76i64) & 1,
            v12,
            &v13->FileName.Length);
    MiDereferenceControlAreaFile(a3, (unsigned __int64)v13);
    if( v14 < 0 )
      return(unsigned int)v14;
  }
LABEL_19:
  v15 = v4;
  ObjectSecurity = 0;
  v17 = v4 & 0x400000;
  v18 = v15 & 0x200000;
  if( v18 || v17 )
  {
    MemoryAllocated = 0;
    v19 = MiReferenceControlAreaFile((_CONTROL_AREA *)a3);
    ObjectSecurity = ObpGetObjectSecurity(v19, &SecurityDescriptor, &MemoryAllocated, 0);
    if( ObjectSecurity < 0 )
    {
      ObjectSecurity = -1073741790;
    }
    else
    {
      v20 = SecurityDescriptor;
      if( (unsigned int)SeQueryMandatoryLabel(SecurityDescriptor) <= 0x1000 && !SeGetTrustLabelAce(v20) )
        ObjectSecurity = -1073741790;
      ObReleaseObjectSecurity(v20, MemoryAllocated);
    }
    if( ObjectSecurity == -1073741790 )
    {
      EtwTimLogProhibitLowILImageMap((unsigned int)(v18 != 0) + 1, a1, &v19->FileName.Length);
      if( !v18 )
        ObjectSecurity = 0;
    }
    MiDereferenceControlAreaFile(a3, (unsigned __int64)v19);
  }
  return(unsigned int)ObjectSecurity;
}

Referenced by: