SepIsImageInMinTcbList

__int64 __fastcall SepIsImageInMinTcbList(
        __int64 a1,
        unsigned int a2,
        UNICODE_STRING *a3,
        char a4,
        unsigned __int8 a5,
        char a6,
        char *a7,
        char *a8,
        unsigned __int8 *a9){
  unsigned int v9; 
  unsigned int v14; 
  _DWORD *i; 
  __int64 v16; 
  __int64 *v17; 
  INT64 v18; 
  unsigned __int64 v20; 
  unsigned __int8 v21; 
  char *v22; 
  char v23; 
  char *v24; 
  char v25; 
  unsigned __int8 *v26; 
  int v27; 
  int v28; 
  UINT64 BufferSize; 
  HANDLE Handle; 
  int Buffer; 
  v9 = 0;
  v14 = 0;
  if( a2 )
  {
    for( i = (_DWORD *)(a1 + 20); ; i += 6 )
    {
      v16 = v14;
      if( RtlEqualUnicodeString(a3, (UNICODE_STRING *)(a1 + 24i64 * v14), 1u) )
      {
        if( !*i || *i == dword_140C19650 )
          break;
      }
      if( ++v14 >= a2 )
        return(unsigned int)-1073741275;
    }
    v20 = 3i64 * v14;
    v21 = *(_BYTE *)(a1 + 24i64 * v14 + 18);
    if( v21 )
      goto LABEL_9;
    if( a5 )
      v21 = a5;
    if( v21 )
    {
LABEL_9:
      v22 = a7;
      v17 = &SeProtectedMapping;
      v20 = (unsigned __int64)v21 >> 4;
      *a7 = *((_BYTE *)&SeProtectedMapping + 2 * v20);
      v23 = *((_BYTE *)&SeProtectedMapping + 2 * v20 + 1);
    }
    else
    {
      v22 = a7;
      *a7 = *(_BYTE *)(a1 + 24 * v16 + 16);
      v23 = *(_BYTE *)(a1 + 24 * v16 + 17);
    }
    v24 = a8;
    v25 = a6;
    *a8 = v23;
    if( !qword_140C1D900 || (LOBYTE(v20) = *v22, LOBYTE(v17) = v25, !(unsigned int)qword_140C1D900(v20, v17)) )
      *v22 = v25;
    if( !qword_140C1D900 || (LOBYTE(v20) = *v24, LOBYTE(v17) = v25, !(unsigned int)qword_140C1D900(v20, v17)) )
      *v24 = v25;
    v26 = a9;
    if( (v21 & 7) != 1 && ((a4 & 1) != 0 || (v21 & 7) == 2) )
    {
      if( (*v24 & 0xFu) < 4 )
        *v24 = *v22;
      v21 = *v26 & 8 | v21 & 0xF2 | 2;
    }
    *v26 = v21;
    Buffer = 0;
    Handle = 0i64;
    if( !*v26 && !*v24 && RtlpOpenImageFileOptionsKeyEx(&a3->Length, (INT64)v17, v18, &Handle) >= 0 )
    {
      LODWORD(BufferSize) = 4;
      v27 = RtlQueryImageFileKeyOption(Handle, L"AuditLevel", 4ui64, &Buffer, BufferSize, 0i64);
      if( v27 >= 0 )
      {
        v28 = Buffer & 0xF;
        if( (unsigned int)(v28 - 2) <= 0xD )
        {
          *v24 = v28;
          *v26 = 8;
        }
      }
      ZwClose(Handle);
    }
  }
  else
  {
    return(unsigned int)-1073741275;
  }
  return v9;
}

Referenced by: