NtFilterBootOption

__int64 __fastcall NtFilterBootOption(int a1, int a2, unsigned int a3, _QWORD *a4, size_t Size){
  int v6; 
  int v7; 
  INT64 v8; 
  int v9; 
  unsigned int v10; 
  int v11; 
  int v12; 
  _QWORD *v13; 
  unsigned int v14; 
  unsigned int *v15; 
  int v16; 
  __int16 v17; 
  __int64 v18; 
  INT64 IsMember; 
  PVOID P; 
  UINT8 dst[72]; 
  v6 = a2;
  v7 = a1;
  P = 0i64;
  *(_QWORD *)dst = 0i64;
  LOBYTE(IsMember) = SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, *((_BYTE *)KeGetCurrentThread() + 562));
  if( !(_BYTE)IsMember
    && ((int)RtlCheckTokenMembership(
               0i64,
               SeAliasAdminsSid,
               (UINT8 *)&IsMember,
               v8,
               IsMember,
               (INT64)P,
               *(INT64 *)dst,
               *(INT64 *)&dst[8]) < 0
     || !(_BYTE)IsMember) )
  {
    v9 = -1073741790;
    goto LABEL_58;
  }
  if( !qword_140CF4AF8 )
  {
    v9 = -2143092730;
    goto LABEL_58;
  }
  if( v7 )
  {
    if( v7 == 1 )
    {
      if( v6 )
      {
        if( a3 )
        {
          if( a4 )
          {
            v10 = Size;
            if( (_DWORD)Size )
            {
              v12 = dword_140CF9D98;
              if( !_bittest(&v12, HIBYTE(a3) & 0xF) )
              {
LABEL_22:
                v9 = 0;
                goto LABEL_58;
              }
              if( *((_BYTE *)KeGetCurrentThread() + 562) )
              {
                if( (unsigned __int64)a4 + (unsigned int)Size > 0x7FFFFFFF0000i64
                  || (_QWORD *)((char *)a4 + (unsigned int)Size) < a4 )
                {
                  MEMORY[0x7FFFFFFF0000] = 0;
                }
                if( (unsigned int)Size > 8 )
                {
                  P = ExAllocatePoolWithTag(PagedPool, (unsigned int)Size, 0x62536553ui64);
                  if( !P )
                  {
                    v9 = -1073741801;
                    HIDWORD(IsMember) = -1073741801;
                    goto LABEL_58;
                  }
                  v13 = P;
                  memmove((UINT8 *)P, (UINT8 *)a4, (unsigned int)Size);
                  a4 = v13;
                  v6 = a2;
                }
                else
                {
                  memmove(dst, (UINT8 *)a4, (unsigned int)Size);
                  a4 = dst;
                }
                v7 = a1;
              }
              goto LABEL_33;
            }
          }
        }
      }
    }
    else
    {
      if( v7 != 2 )
      {
        v9 = -1073741585;
        goto LABEL_58;
      }
      if( v6 )
      {
        if( a3 )
        {
          if( !a4 )
          {
            v10 = Size;
            if( !(_DWORD)Size )
            {
              v11 = dword_140CF9D98;
              if( !_bittest(&v11, HIBYTE(a3) & 0xF) )
                goto LABEL_22;
LABEL_33:
              v14 = 0;
              v9 = 0;
              if( *((_WORD *)qword_140CF4AF8 + 18) )
              {
                v15 = (unsigned int *)(qword_140CF9DA8 + 8);
                while( 1 )
                {
                  if( *(v15 - 1) == a3 )
                  {
                    v16 = *(v15 - 2);
                    if( !v16 || v16 == v6 )
                    {
                      v17 = *(_WORD *)(*v15 + qword_140CF9DA0);
                      if( ((v17 & 0x20) == 0 || (dword_140C54384 & 4) != 0)
                        && ((v17 & 0x40) == 0 || (dword_140C54384 & 0x10) != 0) )
                      {
                        break;
                      }
                    }
                  }
                  ++v14;
                  v15 += 3;
                  if( v14 >= *((unsigned __int16 *)qword_140CF4AF8 + 18) )
                    goto LABEL_22;
                }
                if( v7 == 1 )
                {
                  v9 = SepSecureBootValidateBcdDataAgainstBcdRule(qword_140CF9DA8 + 12i64 * v14, (BYTE *)a4, v10);
                }
                else
                {
                  v9 = 0;
                  v18 = *(unsigned int *)(qword_140CF9DA8 + 12i64 * v14 + 8);
                  if( (*(_BYTE *)(v18 + qword_140CF9DA0) & 0x1F) != 8 || *(_WORD *)(v18 + qword_140CF9DA0 + 2) )
                    v9 = -1069350910;
                }
              }
              goto LABEL_58;
            }
          }
        }
      }
    }
LABEL_57:
    v9 = -1073741811;
    goto LABEL_58;
  }
  if( v6 || a3 || a4 || (_DWORD)Size )
    goto LABEL_57;
  HIDWORD(IsMember) = 0;
  if( !_InterlockedCompareExchange(&dword_140CF9D94, 0, 0) )
  {
    v9 = SepSecureBootCorrectBcd();
    HIDWORD(IsMember) = v9;
    if( v9 < 0 )
      goto LABEL_58;
    _InterlockedExchange(&dword_140CF9D94, 1);
  }
  v9 = HIDWORD(IsMember);
LABEL_58:
  if( P )
    ExFreePoolWithTag(P, 0x62536553u);
  return(unsigned int)v9;
}

Referenced by: