RtlGenerateClass5Guid

NTSTATUS __stdcall RtlGenerateClass5Guid(
        const _GUID *const NamespaceGuid,
        VOID *Buffer,
        UINT64 BufferSize,
        _GUID *Guid){
  VOID **PoolWithTag; 
  ULONG v6; 
  UINT32 v9; 
  int Property; 
  UINT32 v11; 
  ULONG v12; 
  unsigned __int32 v13; 
  ULONG v14; 
  ULONG v15; 
  UCHAR *pcbResult; 
  UINT32 v18; 
  ULONG v19; 
  ULONG v20; 
  UCHAR pbOutput[4]; 
  BCRYPT_HASH_HANDLE phHash; 
  _BCRYPT_ALG_HANDLE phAlgorithm[2]; 
  UINT32 v24; 
  UCHAR pbInput[16]; 
  _GUID v26; 

  v24 = 0;
  PoolWithTag = 0i64;
  *(_DWORD *)pbOutput = 0;
  *(_QWORD *)phAlgorithm = 0i64;
  phHash = 0i64;
  v6 = BufferSize;
  *(_OWORD *)pbInput = 0i64;
  if( !NamespaceGuid )
    return -1073741585;
  if( !Guid )
    return -1073741582;
  if( !Buffer && (_DWORD)BufferSize )
    return -1073741583;
  Property = (unsigned int)BCryptOpenAlgorithmProvider(
                             phAlgorithm,
                             (_LPCWSTR)L"SHA1",
                             (_LPCWSTR)L"Microsoft Primitive Provider",
                             0);
  if( Property >= 0 )
  {
    Property = (unsigned int)BCryptGetProperty(
                               *(BCRYPT_HANDLE *)phAlgorithm,
                               (_LPCWSTR)L"ObjectLength",
                               pbOutput,
                               v11,
                               &v24,
                               v18);
    if( Property >= 0 )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, *(unsigned int *)pbOutput, 1684632903i64);
      if( !PoolWithTag )
        Property = -1073741670;
      if( Property >= 0 )
      {
        Property = BCryptCreateHash(
                     phAlgorithm[0],
                     &phHash,
                     (PUCHAR)PoolWithTag,
                     *(ULONG *)pbOutput,
                     pcbResult,
                     v19,
                     v20);
        if( Property >= 0 )
        {
          v13 = _byteswap_ulong(NamespaceGuid->Data1);
          *(_GUID *)pbInput = *NamespaceGuid;
          *(_DWORD *)pbInput = v13;
          *(_WORD *)&pbInput[4] = __ROR2__(NamespaceGuid->Data2, 8);
          *(_WORD *)&pbInput[6] = __ROR2__(NamespaceGuid->Data3, 8);
          Property = BCryptHashData(phHash, pbInput, 0x10u, v12);
          if( Property >= 0 )
          {
            Property = BCryptHashData(phHash, (PUCHAR)Buffer, v6, v14);
            if( Property >= 0 )
            {
              Property = BCryptFinishHash(phHash, (PUCHAR)&v26, 0x14u, v15);
              if( Property >= 0 )
              {
                *Guid = v26;
                Guid->Data1 = _byteswap_ulong(Guid->Data1);
                Guid->Data2 = __ROR2__(Guid->Data2, 8);
                Guid->Data3 = __ROR2__(Guid->Data3, 8) & 0xFFF | 0x5000;
                Guid->Data4[0] = Guid->Data4[0] & 0x3F | 0x80;
              }
            }
          }
        }
      }
    }
  }
  if( phHash )
    BCryptDestroyHash(phHash);
  if( *(_QWORD *)phAlgorithm )
    BCryptCloseAlgorithmProvider(phAlgorithm[0], v9);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return Property;
}

Referenced by: