SepGetLearningModeObjectInformation

CHAR *__fastcall SepGetLearningModeObjectInformation(BYTE *a1){
  struct _UNICODE_STRING *v1; 
  UINT8 *v2; 
  int CurrentLogLevel; 
  _BYTE *v4; 
  __int64 v5; 
  CHAR *result; 
  _ETHREAD *CurrentThread; 
  __int64 v8; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  unsigned __int64 v11; 
  _OWORD *PoolWithTag; 
  struct _UNICODE_STRING *v13; 
  struct _UNICODE_STRING *v14; 
  struct _UNICODE_STRING *v15; 
  UINT8 *v16; 
  WCHAR v17; 
  WCHAR v18; 
  __int128 Src; 
  __int128 v20; 
  unsigned __int64 v22; 
  v1 = 0i64;
  v2 = 0i64;
  CurrentLogLevel = SepGetCurrentLogLevel();
  *v4 = 0;
  result = *(CHAR **)(v5 + 1448);
  if( !result || *((_DWORD *)result + 2) != CurrentLogLevel )
  {
    if( *((_BYTE *)KeGetCurrentThread() + 562) == 1 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      if( (*((_DWORD *)CurrentThread + 29) & 0x400) != 0 || *((_BYTE *)CurrentThread + 586) == 1 )
        v8 = 0i64;
      else
        v8 = *((_QWORD *)CurrentThread + 30);
      if( !v8 )
        return 0i64;
      v9 = *(_QWORD *)(v8 + 40);
      if( !v9 )
        return 0i64;
      if( (v9 & 7) != 0 )
        ExRaiseDatatypeMisalignment();
      if( v9 + 24 > 0x7FFFFFFF0000i64 || v9 + 24 < v9 )
        MEMORY[0x7FFFFFFF0000] = 0;
      if( *(_DWORD *)v9 != -1395763957 )
        return 0i64;
      v22 = *(_QWORD *)(v9 + 8);
      v10 = *(_QWORD *)(v9 + 16);
      if( (v22 & 7) != 0 )
        ExRaiseDatatypeMisalignment();
      if( v22 + 16 > 0x7FFFFFFF0000i64 || v22 + 16 < v22 )
        MEMORY[0x7FFFFFFF0000] = 0;
      if( (v10 & 7) != 0 )
        ExRaiseDatatypeMisalignment();
      if( v10 + 16 > 0x7FFFFFFF0000i64 || v10 + 16 < v10 )
        MEMORY[0x7FFFFFFF0000] = 0;
      Src = *(_OWORD *)v22;
      v20 = *(_OWORD *)v10;
      if( WORD1(*(_OWORD *)v22) )
      {
        if( (BYTE8(Src) & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        v11 = *((_QWORD *)&Src + 1) + WORD1(Src);
        if( v11 > 0x7FFFFFFF0000i64 || v11 < *((_QWORD *)&Src + 1) )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      if( WORD1(v20) )
      {
        if( (BYTE8(v20) & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        if( *((_QWORD *)&v20 + 1) + (unsigned __int64)WORD1(v20) > 0x7FFFFFFF0000i64
          || *((_QWORD *)&v20 + 1) + (unsigned __int64)WORD1(v20) < *((_QWORD *)&v20 + 1) )
        {
          MEMORY[0x7FFFFFFF0000] = 0;
        }
      }
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x38ui64, 0x494F6553ui64);
      if( PoolWithTag )
      {
        *PoolWithTag = 0i64;
        PoolWithTag[1] = 0i64;
        PoolWithTag[2] = 0i64;
        *((_QWORD *)PoolWithTag + 6) = 0i64;
        v13 = (struct _UNICODE_STRING *)ExAllocatePoolWithTag(PagedPool, 0x10ui64, 0x544F6553ui64);
        v14 = v13;
        if( v13 )
        {
          *v13 = 0i64;
          v2 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, WORD1(Src), 0x544F6553ui64);
          if( v2 )
          {
            v15 = (struct _UNICODE_STRING *)ExAllocatePoolWithTag(PagedPool, 0x10ui64, 0x4E4F6553ui64);
            v1 = v15;
            if( v15 )
            {
              *v15 = 0i64;
              v16 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, WORD1(v20), 0x4E4F6553ui64);
              if( v16 )
              {
                memmove(v2, *((UINT8 **)&Src + 1), WORD1(Src));
                RtlInitUnicodeString(v14, (PCWSTR)v2, v17);
                memmove(v16, *((UINT8 **)&v20 + 1), WORD1(v20));
                RtlInitUnicodeString(v1, (PCWSTR)v16, v18);
                *((_QWORD *)PoolWithTag + 2) = v14;
                *((_QWORD *)PoolWithTag + 3) = v1;
                *a1 = 1;
                return(CHAR *)PoolWithTag;
              }
            }
          }
        }
        if( v14 )
          ExFreePoolWithTag(v14, 0);
        if( v2 )
          ExFreePoolWithTag(v2, 0);
        if( v1 )
          ExFreePoolWithTag(v1, 0);
        ExFreePoolWithTag(PoolWithTag, 0);
      }
    }
    return 0i64;
  }
  return result;
}

Referenced by: