PspDetectComplusILImage

NTSTATUS __stdcall PspDetectComplusILImage(
        PSP_CREATE_PROCESS_CONTEXT *CreateContext,
        UINT64 *CreateFlags,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  char v8; 
  NTSTATUS result; 
  char ComPlusPackage; 
  NTSTATUS v13; 
  VOID *v14; 
  int v15; 
  UINT64 BufferSize; 
  char v17; 
  int Buffer; 

  v8 = *((_BYTE *)CreateContext + 99);
  if( (v8 & 1) == 0 || (v8 & 0x20) != 0 )
    return 0;
  ComPlusPackage = KUSER_SHARED_DATA.ComPlusPackage;
  v13 = 0;
  v17 = KUSER_SHARED_DATA.ComPlusPackage;
  if( KUSER_SHARED_DATA.ComPlusPackage != -1 )
    goto LABEL_6;
  ZwQuerySystemInformation();
  if( result >= 0 )
  {
    ComPlusPackage = v17;
LABEL_6:
    if( (ComPlusPackage & 1) != 0 )
    {
      v14 = (VOID *)*((_QWORD *)CreateContext + 24);
      if( v14 )
      {
        LODWORD(BufferSize) = 4;
        Buffer = 0;
        v15 = RtlQueryImageFileKeyOption(v14, (WCHAR *)L"Wow64", 4ui64, &Buffer, BufferSize, 0i64);
        if( (v15 < 0 || Buffer) && v15 != -1073741772 )
        {
          if( v15 < 0 )
            return v15;
          return v13;
        }
      }
      else if( (CreateContext[2] & 0x40) == 0 )
      {
        return -1073741823;
      }
      *(_DWORD *)CreateFlags |= 8u;
    }
    return v13;
  }
  return result;
}

Referenced by: