SepMandatoryIntegrityCheck

__int64 __fastcall SepMandatoryIntegrityCheck(
        int *a1,
        __int64 CurrentIrql,
        char a3,
        __int64 a4,
        char a5,
        char a6,
        __int64 a7){
  int v7; 
  char v8; 
  int v9; 
  __int16 v11; 
  __int64 v12; 
  __int64 v13; 
  unsigned int v14; 
  int v15; 
  unsigned __int16 *v16; 
  __int64 v17; 
  _WORD **v18; 
  _WORD *v19; 
  int v20; 
  int v21; 
  unsigned __int16 v22; 
  unsigned __int16 v23; 
  int v24; 
  int v25; 
  NTSTATUS v26; 
  __int16 v27; 
  bool v28; 
  unsigned int v30; 
  unsigned int v31; 
  char v32; 
  char v33; 
  char v34; 
  char v35; 
  __int64 result; 
  __int64 v37; 
  char v38; 
  int v39; 
  int v40; 
  int v41; 
  _ETHREAD *CurrentThread; 
  _WORD *v43; 
  __int16 v44; 
  unsigned __int8 v45; 
  _ETHREAD *v46; 
  CHAR *OwnerEntryForLegacyShim; 
  int v48; 
  int v49; 
  char v50; 
  char v51; 
  v7 = *(_DWORD *)(a4 + 212);
  v8 = 0;
  v9 = 0;
  v50 = 0;
  *(_DWORD *)(a7 + 8) = v7;
  if( (v7 & 0xFFFFFFFD) != 0 )
  {
    if( a3 )
      goto LABEL_47;
    v11 = *(_WORD *)(CurrentIrql + 2);
    if( (v11 & 0x10) == 0 )
      goto LABEL_47;
    if( v11 < 0 )
    {
      v37 = *(unsigned int *)(CurrentIrql + 12);
      if( !(_DWORD)v37 )
        goto LABEL_47;
      v12 = CurrentIrql + v37;
    }
    else
    {
      v12 = *(_QWORD *)(CurrentIrql + 24);
    }
    if( v12 )
    {
      v13 = v12 + 8;
      v14 = 0;
      if( *(_WORD *)(v12 + 4) )
      {
        while( *(_BYTE *)v13 != 17 )
        {
          ++v14;
          v13 += *(unsigned __int16 *)(v13 + 2);
          if( v14 >= *(unsigned __int16 *)(v12 + 4) )
            goto LABEL_47;
        }
        if( (*(_BYTE *)(v13 + 1) & 8) == 0 )
        {
          v15 = *(_DWORD *)(v13 + 4);
          v16 = (unsigned __int16 *)(v13 + 8);
          v51 = v15;
LABEL_11:
          if( a5 )
          {
            CurrentThread = (_ETHREAD *)KeGetCurrentThread();
            --*((_WORD *)CurrentThread + 242);
            v43 = *(_WORD **)(a4 + 48);
            if( (v43[13] & 0x41) == 1 )
              KeBugCheckEx(0x1C6u, 0xFui64, (ULONG_PTR)v43, 0i64, 0i64);
            v44 = v43[13] & 1;
            if( v44 )
            {
              v45 = KeGetCurrentIrql();
              v46 = (_ETHREAD *)KeGetCurrentThread();
              if( v45 > 1u )
                KeBugCheckEx(0x1C6u, 0i64, v45, 1ui64, 0i64);
              if( (*((_BYTE *)v46 + 192) & 2) != 0 )
                KeBugCheckEx(0x1C6u, 6ui64, 0i64, 0i64, 0i64);
              if( !v45 && (*((_DWORD *)v46 + 29) & 0x400) == 0 && !*((_DWORD *)v46 + 121) )
                KeBugCheckEx(0x1C6u, 7ui64, 0i64, 0i64, 0i64);
            }
            if( v44 )
            {
              OwnerEntryForLegacyShim = ExpAllocateOwnerEntryForLegacyShim();
              if( !(unsigned __int8)ExAcquireFastResourceShared(v43, OwnerEntryForLegacyShim) )
                ExFreePoolWithTag(OwnerEntryForLegacyShim, 0);
            }
            else
            {
              ExpAcquireResourceSharedLite(*(PVOID *)(a4 + 48), 1);
            }
          }
          v17 = *(unsigned int *)(a4 + 208);
          if( (_DWORD)v17 == -1 || (v18 = (_WORD **)(*(_QWORD *)(a4 + 152) + 16 * v17)) == 0i64 )
            v19 = SeUntrustedMandatorySid;
          else
            v19 = *v18;
          if( a6 )
            v19 = SepDefaultMandatorySid;
          if( a5 )
          {
            ExReleaseResourceLite(*(PERESOURCE *)(a4 + 48));
            KeLeaveCriticalRegion();
          }
          v20 = *((unsigned __int8 *)v16 + 1);
          if( (_BYTE)v20 )
            v21 = *(_DWORD *)&v16[2 * (v20 - 1) + 4];
          else
            v21 = 0;
          *(_DWORD *)(a7 + 12) = v21;
          v22 = *v16;
          v23 = *v19;
          if( *v16 == *v19 && !memcmp(v16, v19, 4 * ((unsigned __int64)*v16 >> 8) + 8) )
            goto LABEL_50;
          v24 = *(_DWORD *)(v19 + 1);
          if( !v24 )
            v24 = (unsigned __int16)v19[3] - 4096;
          if( v24 )
            goto LABEL_92;
          v25 = *(_DWORD *)(v16 + 1);
          if( !v25 )
            v25 = v16[3] - 4096;
          if( v25 )
          {
LABEL_92:
            v34 = 0;
            v31 = -1073741811;
            v35 = 0;
LABEL_45:
            result = v31;
            *(_BYTE *)(a7 + 4) = v35;
            *(_DWORD *)a7 = v9;
            *(_BYTE *)(a7 + 5) = v8;
            *(_BYTE *)(a7 + 6) = v34;
            return result;
          }
          LOWORD(v26) = HIBYTE(v23);
          v27 = HIBYTE(v22);
          if( v23 == v22
            && (v26 = memcmp(v19, v16, 4i64 * HIBYTE(v23) + 8),
                LOBYTE(v27) = HIBYTE(v22),
                v28 = v26 == 0,
                LOBYTE(v26) = HIBYTE(v23),
                v28) )
          {
LABEL_50:
            v31 = 0;
          }
          else
          {
            if( (_BYTE)v26 )
            {
              v30 = *(_DWORD *)&v19[2 * (unsigned __int8)v26 + 2];
              v31 = 0;
            }
            else
            {
              v31 = 0;
              v30 = 0;
            }
            if( (_BYTE)v27 && v30 < *(_DWORD *)&v16[2 * (unsigned __int8)v27 + 2] )
            {
              v32 = 0;
LABEL_38:
              if( (*(_DWORD *)(a7 + 8) & 1) != 0 && (v8 = 1, v9 = *a1 | ~*a1 & a1[2] | 0x120000, v32) )
              {
                v33 = 1;
                v50 = 1;
                v9 |= a1[3] | 0x11FFFFF;
              }
              else
              {
                v33 = 0;
              }
              v34 = v8;
              if( v32 )
              {
                v35 = v50;
              }
              else
              {
                v38 = 0;
                if( (v51 & 2) == 0 )
                  v38 = v8;
                if( (v51 & 4) != 0 )
                  v34 = 0;
                v35 = 0;
                if( (v51 & 1) == 0 )
                  v35 = v33;
                if( (v51 & 2) != 0 )
                {
                  v39 = 0;
                  if( v35 )
                    v39 = a1[1] | 0x10D0000;
                  v40 = *a1;
                  if( v34 )
                    v39 |= ~v40 & a1[2] | 0x100000;
                  v9 &= v39 | ~(v40 | 0x20000);
                }
                if( (v51 & 4) != 0 )
                {
                  v48 = 0;
                  if( v35 )
                    v48 = a1[1] | 0x10D0000;
                  v49 = *a1;
                  if( v38 )
                    v48 |= v49 | 0x20000;
                  v9 &= ~(~v48 & (~v49 & a1[2] | 0x100000));
                }
                v8 = v38;
                if( (v51 & 1) != 0 )
                {
                  v41 = 0;
                  if( v34 )
                    v41 = ~*a1 & a1[2] | 0x100000;
                  if( v38 )
                    v41 |= *a1 | 0x20000;
                  v9 &= ~(~v41 & (a1[1] | 0x10D0000));
                }
              }
              if( (*(_QWORD *)(a4 + 72) & 0x100000000i64) != 0 )
                v9 |= 0x80000u;
              goto LABEL_45;
            }
          }
          v32 = 1;
          goto LABEL_38;
        }
      }
    }
LABEL_47:
    v16 = (unsigned __int16 *)SepDefaultMandatorySid;
    v51 = 1;
    goto LABEL_11;
  }
  *(_DWORD *)a7 = a1[3];
  result = 0i64;
  *(_WORD *)(a7 + 4) = 257;
  *(_BYTE *)(a7 + 6) = 1;
  return result;
}

Referenced by: