WmipGetGuidSecurityDescriptor

NTSTATUS __stdcall WmipGetGuidSecurityDescriptor(_UNICODE_STRING *GuidName, VOID **SecurityDescriptor){
  unsigned int v4; 
  _KEXCEPTION_FRAME *a5; 
  int v6; 
  NTSTATUS PersistedStateLocation; 
  PVOID v8; 
  INT64 a6; 
  INT64 a7; 
  PVOID P; 
  VOID *SecurityDescriptora[24]; 

  SecurityDescriptora[0] = 0i64;
  P = 0i64;
  v4 = 0;
  LODWORD(a7) = 0;
  a5 = 0i64;
  memset(&SecurityDescriptora[2], 0i64, 0xA8u);
  LODWORD(SecurityDescriptora[10]) = 0;
  SecurityDescriptora[2] = WmipSDRegistryQueryRoutine;
  LODWORD(SecurityDescriptora[6]) = 3;
  SecurityDescriptora[5] = SecurityDescriptora;
  SecurityDescriptora[4] = GuidName->Buffer;
  SecurityDescriptora[12] = &P;
  SecurityDescriptora[9] = WmipSDRegistryQueryRoutine;
  LODWORD(SecurityDescriptora[13]) = 3;
  SecurityDescriptora[11] = &ExceptionFrame._Xmm7;
  LOBYTE(v6) = RtlpQueryRegistryValues((_KTRAP_FRAME *)2, (_KEXCEPTION_FRAME *)&ExceptionFrame);
  *SecurityDescriptor = 0i64;
  if( v6 < 0 )
    goto LABEL_14;
  while( 1 )
  {
    if( v4 )
    {
      a5 = (_KEXCEPTION_FRAME *)ExAllocatePoolWithTag(1ui64, v4, 1885957463i64);
      if( !a5 )
        return -1073741670;
    }
    LODWORD(a6) = v4;
    PersistedStateLocation = RtlGetPersistedStateLocation(
                               (WCHAR *)&ExceptionFrame.P5,
                               0i64,
                               0i64,
                               0i64,
                               a5,
                               a6,
                               (INT64)&a7);
    if( PersistedStateLocation != -2147483643 )
      break;
    if( a5 )
    {
      ExFreePoolWithTag(a5, 0);
      a5 = 0i64;
    }
    v4 = a7;
  }
  if( !PersistedStateLocation )
  {
    if( SecurityDescriptora[0] )
    {
      SecurityDescriptora[7] = SecurityDescriptora;
      LODWORD(SecurityDescriptora[8]) = RtlLengthSecurityDescriptor((INT64)SecurityDescriptora[0]);
    }
    if( P )
    {
      SecurityDescriptora[14] = &P;
      LODWORD(SecurityDescriptora[15]) = RtlLengthSecurityDescriptor((INT64)P);
    }
    RtlpQueryRegistryValues(0i64, a5);
  }
  if( SecurityDescriptora[0] )
  {
    v8 = P;
    *SecurityDescriptor = SecurityDescriptora[0];
    if( v8 )
      ExFreePoolWithTag(v8, 0);
  }
  else if( P )
  {
    *SecurityDescriptor = P;
  }
  if( !*SecurityDescriptor )
LABEL_14:
    *SecurityDescriptor = (VOID *)WmipDefaultAccessSd;
  if( a5 )
    ExFreePoolWithTag(a5, 0);
  return 0;
}

Referenced by: