NtFilterBootOption

NTSTATUS __stdcall NtFilterBootOption(
        _FILTER_BOOT_OPTION_OPERATION FilterOperation,
        UINT64 ObjectType,
        UINT64 ElementType,
        VOID *Data,
        UINT64 DataSize){
  unsigned int v5; 
  int v6; 
  _FILTER_BOOT_OPTION_OPERATION v7; 
  NTSTATUS v8; 
  unsigned int v9; 
  int v10; 
  int v11; 
  VOID *v12; 
  unsigned int v13; 
  unsigned int *v14; 
  int v15; 
  __int16 v16; 
  __int64 v17; 
  char IsMember[4]; 
  NTSTATUS v20; 
  PVOID P; 
  __int64 v22[9]; 
  int v24; 

  v24 = ObjectType;
  v5 = ElementType;
  v6 = ObjectType;
  v7 = FilterOperation;
  P = 0i64;
  v22[0] = 0i64;
  IsMember[0] = SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, KeGetCurrentThread()->PreviousMode);
  if( !IsMember[0] && (RtlCheckTokenMembership(0i64, SeAliasAdminsSid, (UINT8 *)IsMember) < 0 || !IsMember[0]) )
  {
    v8 = -1073741790;
    goto LABEL_58;
  }
  if( !*(&stru_140CF2E80 + 911) )
  {
    v8 = -2143092730;
    goto LABEL_58;
  }
  if( v7 )
  {
    if( v7 == FilterBootOptionOperationSetElement )
    {
      if( v6 )
      {
        if( v5 )
        {
          if( Data )
          {
            v9 = DataSize;
            if( (_DWORD)DataSize )
            {
              v11 = dword_140CF9D98;
              if( !_bittest(&v11, HIBYTE(v5) & 0xF) )
              {
LABEL_22:
                v8 = 0;
                goto LABEL_58;
              }
              if( KeGetCurrentThread()->PreviousMode )
              {
                if( (unsigned __int64)Data + (unsigned int)DataSize > 0x7FFFFFFF0000i64
                  || (char *)Data + (unsigned int)DataSize < Data )
                {
                  MEMORY[0x7FFFFFFF0000] = 0;
                }
                if( (unsigned int)DataSize > 8 )
                {
                  P = ExAllocatePoolWithTag(1ui64, (unsigned int)DataSize, 1649632595i64);
                  if( !P )
                  {
                    v8 = -1073741801;
                    v20 = -1073741801;
                    goto LABEL_58;
                  }
                  v12 = P;
                  memmove(P, Data, DataSize);
                  Data = v12;
                  v6 = v24;
                }
                else
                {
                  memmove(v22, Data, DataSize);
                  Data = v22;
                }
                v7 = FilterOperation;
              }
              goto LABEL_33;
            }
          }
        }
      }
    }
    else
    {
      if( v7 != FilterBootOptionOperationDeleteElement )
      {
        v8 = -1073741585;
        goto LABEL_58;
      }
      if( v6 )
      {
        if( v5 )
        {
          if( !Data )
          {
            v9 = DataSize;
            if( !(_DWORD)DataSize )
            {
              v10 = dword_140CF9D98;
              if( !_bittest(&v10, HIBYTE(v5) & 0xF) )
                goto LABEL_22;
LABEL_33:
              v13 = 0;
              v8 = 0;
              if( *(_WORD *)(*(&stru_140CF2E80 + 911) + 36i64) )
              {
                v14 = (unsigned int *)(qword_140CF9DA8 + 8);
                while( 1 )
                {
                  if( *(v14 - 1) == v5 )
                  {
                    v15 = *(v14 - 2);
                    if( !v15 || v15 == v6 )
                    {
                      v16 = *(_WORD *)(*v14 + qword_140CF9DA0);
                      if( ((v16 & 0x20) == 0 || (dword_140C54384 & 4) != 0)
                        && ((v16 & 0x40) == 0 || (dword_140C54384 & 0x10) != 0) )
                      {
                        break;
                      }
                    }
                  }
                  ++v13;
                  v14 += 3;
                  if( v13 >= *(unsigned __int16 *)(*(&stru_140CF2E80 + 911) + 36i64) )
                    goto LABEL_22;
                }
                if( v7 == FilterBootOptionOperationSetElement )
                {
                  v8 = SepSecureBootValidateBcdDataAgainstBcdRule(qword_140CF9DA8 + 12i64 * v13, Data, v9);
                }
                else
                {
                  v8 = 0;
                  v17 = *(unsigned int *)(qword_140CF9DA8 + 12i64 * v13 + 8);
                  if( (*(_BYTE *)(v17 + qword_140CF9DA0) & 0x1F) != 8 || *(_WORD *)(v17 + qword_140CF9DA0 + 2) )
                    v8 = -1069350910;
                }
              }
              goto LABEL_58;
            }
          }
        }
      }
    }
LABEL_57:
    v8 = -1073741811;
    goto LABEL_58;
  }
  if( v6 || v5 || Data || (_DWORD)DataSize )
    goto LABEL_57;
  v20 = 0;
  if( !_InterlockedCompareExchange(&dword_140CF9D94, 0, 0) )
  {
    v8 = SepSecureBootCorrectBcd();
    v20 = v8;
    if( v8 < 0 )
      goto LABEL_58;
    _InterlockedExchange(&dword_140CF9D94, 1);
  }
  v8 = v20;
LABEL_58:
  if( P )
    ExFreePoolWithTag(P, 0x62536553u);
  return v8;
}

Referenced by: