MiValidateSectionSigningPolicy

NTSTATUS __stdcall MiValidateSectionSigningPolicy(
        UINT64 a1,
        UINT64 a2,
        INT64 a3,
        INT64 a4,
        INT64 ProcessToken,
        INT64 a6,
        CHAR a7,
        CHAR a8,
        INT64 a9,
        CHAR SeRequestedSigningLevel,
        CHAR a11){
  int v13; 
  _EPROCESS *Process; 
  int v16; 
  __int64 v17; 
  __int64 v18; 
  int v19; 
  UINT64 SeSecureType; 

  v13 = a1;
  if( (unsigned int)a1 >= 2 )
    return -1073741811;
  if( !a7 && !a8 )
    return 0;
  Process = KeGetCurrentThread()->ApcState.Process;
  v16 = a6 | 0x2000000;
  if( a7 )
    v16 = a6;
  LODWORD(SeSecureType) = v16;
  v19 = MiValidateSectionCreate(
          (PVOID)a2,
          (_CONTROL_AREA *)a3,
          (unsigned int)a4,
          (VOID *)ProcessToken,
          SeSecureType,
          SeRequestedSigningLevel);
  if( v19 < 0 )
  {
    v18 = (unsigned int)(v13 != 1) + 1;
    dword_140C4C958 = (v13 != 1) + 1;
  }
  if( a7 == 1 && v19 < 0 )
  {
    if( v19 == -1073740760 && (_DWORD)a9 == 1 )
      EtwTimLogProhibitNonMicrosoftBinaries(
        2i64,
        (INT64)Process,
        SeRequestedSigningLevel,
        *(_BYTE *)(*(_QWORD *)a3 + 15i64) >> 4,
        (UINT16 *)(a2 + 88));
  }
  else if( a8 == 1 )
  {
    if( v19 < 0 )
    {
      return 0;
    }
    else if( !qword_140C1D900
           || (LOBYTE(v17) = a11,
               LOBYTE(v18) = *(_BYTE *)(*(_QWORD *)a3 + 15i64) >> 4,
               !(unsigned int)qword_140C1D900(v18, v17)) )
    {
      EtwTimLogProhibitNonMicrosoftBinaries(
        1i64,
        (INT64)Process,
        a11,
        *(_BYTE *)(*(_QWORD *)a3 + 15i64) >> 4,
        (UINT16 *)(a2 + 88));
    }
  }
  return v19;
}

Referenced by: