WmipCreateGuidObject

NTSTATUS __stdcall WmipCreateGuidObject(
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        UINT64 DesiredAccess,
        _GUID *Guid,
        _WMIGUIDOBJECT **Object,
        _WMIGUIDOBJECT *Objecta){
  unsigned int v6; 
  _UNICODE_STRING *ObjectName; 
  int GuidSecurityDescriptor; 
  __int128 v11; 
  __int128 v12; 
  PVOID v13; 
  __int128 v14; 
  __int128 v15; 
  char *v16; 
  VOID *v18; 
  UINT64 v19; 
  UINT64 ObjectBodySize; 
  UINT64 v21; 
  UINT64 v22; 
  PVOID SecurityDescriptor; 
  char *DestinationString; 
  _UNICODE_STRING DestinationString_8; 
  _OBJECT_ATTRIBUTES ObjectAttributes_8; 
  _SECURITY_SUBJECT_CONTEXT v27[5]; 
  _AUX_ACCESS_DATA AuxData; 

  SecurityDescriptor = 0i64;
  v6 = DesiredAccess;
  DestinationString_8 = 0i64;
  memset(v27, 0i64, sizeof(v27));
  memset(&AuxData, 0i64, sizeof(AuxData));
  ObjectName = ObjectAttributes->ObjectName;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString_8, (PCWSTR)ObjectName->Buffer + 9);
  GuidSecurityDescriptor = WmipGetGuidSecurityDescriptor(&DestinationString_8, &SecurityDescriptor);
  if( GuidSecurityDescriptor >= 0 )
  {
    v11 = *(_OWORD *)&ObjectAttributes->ObjectName;
    *(_OWORD *)&ObjectAttributes_8.Length = *(_OWORD *)&ObjectAttributes->Length;
    v12 = *(_OWORD *)&ObjectAttributes->SecurityDescriptor;
    v13 = SecurityDescriptor;
    *(&ObjectAttributes_8.Attributes + 1) = HIDWORD(v11);
    ObjectAttributes_8.ObjectName = 0i64;
    ObjectAttributes_8.SecurityQualityOfService = (void *)*((_QWORD *)&v12 + 1);
    ObjectAttributes_8.SecurityDescriptor = SecurityDescriptor;
    ObjectAttributes_8.Attributes = 640;
    GuidSecurityDescriptor = SeCreateAccessState(
                               (_ACCESS_STATE *)v27,
                               &AuxData,
                               v6,
                               (_GENERIC_MAPPING *)&WmipGenericMapping);
    if( GuidSecurityDescriptor >= 0 )
    {
      v14 = *(_OWORD *)&v27[1].ClientToken;
      LODWORD(v22) = 0;
      v15 = *(_OWORD *)&v27[1].PrimaryToken;
      LODWORD(v21) = 0;
      LODWORD(ObjectBodySize) = 168;
      v27[1] = WmipSystemSubjectContext;
      GuidSecurityDescriptor = ObCreateObjectEx(
                                 0i64,
                                 WmipGuidObjectType,
                                 &ObjectAttributes_8,
                                 0i64,
                                 v18,
                                 ObjectBodySize,
                                 v21,
                                 v22,
                                 (VOID **)&DestinationString,
                                 0i64);
      if( GuidSecurityDescriptor >= 0 )
      {
        v16 = DestinationString;
        memset(DestinationString, 0i64, 0xA8u);
        KeInitializeEvent((INT64)v16, 0, 0);
        LODWORD(v19) = 0;
        *((_DWORD *)v16 + 28) = 4096;
        *((_DWORD *)v16 + 36) = 4096;
        *(_GUID *)(v16 + 24) = *Guid;
        GuidSecurityDescriptor = ObInsertObjectEx(v16, (_ACCESS_STATE *)v27, v6, 0i64, v19, 0i64, 0i64);
        if( GuidSecurityDescriptor >= 0 )
        {
          *Object = (_WMIGUIDOBJECT *)v16;
          GuidSecurityDescriptor = 0;
        }
      }
      *(_OWORD *)&v27[1].ClientToken = v14;
      *(_OWORD *)&v27[1].PrimaryToken = v15;
      SepDeleteAccessState((_ACCESS_STATE *)v27);
      SeReleaseSubjectContext(&v27[1]);
    }
    if( v13 && v13 != (PVOID)WmipDefaultAccessSd )
      ExFreePoolWithTag(v13, 0);
  }
  return GuidSecurityDescriptor;
}

Referenced by: