PopCreateNotificationName

NTSTATUS __stdcall PopCreateNotificationName(_WNF_STATE_NAME *StateName){
  UINT64 v1; 
  NTSTATUS result; 
  UINT64 NewType; 
  _UNICODE_STRING CapName; 
  __int128 SecurityDescriptor[2]; 
  __int64 v7; 
  char CapabilitySid[48]; 
  char CapabilityGroupSid[56]; 
  _ACL Acl; 

  *(_QWORD *)&CapName.Length = 2752552i64;
  v7 = 0i64;
  CapName.Buffer = L"lpacPnpNotifications";
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  RtlCreateAcl(&Acl, (_ACL)328i64, 2ui64, v1);
  RtlpAddKnownAce(&Acl, 2ui64, 0i64, 0x1F0003ui64, SeLocalSystemSid, 0);
  RtlpAddKnownAce(&Acl, 2ui64, 0i64, 0x120001ui64, SeWorldSid, 0);
  RtlpAddKnownAce(&Acl, 2ui64, 0i64, 0x120001ui64, SeAllAppPackagesSid, 0);
  result = RtlDeriveCapabilitySidsFromName(&CapName, CapabilityGroupSid, CapabilitySid);
  if( result >= 0 )
  {
    RtlpAddKnownAce(&Acl, 2ui64, 0i64, 0x120001ui64, CapabilitySid, 0);
    RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, &Acl, 0);
    LODWORD(NewType) = 36;
    return ZwCreateWnfStateName(
             StateName,
             WnfTemporaryStateName,
             WnfDataScopeMachine,
             0,
             0i64,
             NewType,
             SecurityDescriptor);
  }
  return result;
}

Referenced by: