NtSetUuidSeed

NTSTATUS __stdcall NtSetUuidSeed(PCHAR Seed){
  void *PoolWithTag; 
  UINT64 v3; 
  void *v4; 
  NTSTATUS v5; 
  unsigned int v6; 
  UINT v7; 
  UINT32 v8; 
  struct _ACL *v9; 
  ACL *v10; 
  int Acl; 
  NTSTATUS v12; 
  int v13; 
  int v14; 
  _ETHREAD *CurrentThread; 
  _BYTE *v16; 
  _BYTE *v17; 
  char v18; 
  UINT64 PreviouslyGrantedAccess; 
  INT64 AccessStatus; 
  __int16 v22; 
  int v24; 
  __int16 v25; 
  unsigned int v26; 
  UINT64 GrantedAccess; 
  PVOID P; 
  PVOID v29; 
  UINT32 v30; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; 
  char SecurityDescriptor[32]; 
  __int64 v33; 
  int v34[6]; 
  AccessStatus = 0i64;
  memset(&SubjectSecurityContext, 0, sizeof(SubjectSecurityContext));
  v34[0] = 80;
  v34[1] = 521322694;
  v34[2] = 906040134;
  v34[3] = -430256637;
  v34[4] = 1525148216;
  v34[5] = -843743134;
  v22 = 1280;
  LODWORD(GrantedAccess) = 0;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v33 = 0i64;
  v29 = 0i64;
  SeCaptureSubjectContext(&SubjectSecurityContext);
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x20ui64, 0x64695555ui64);
  v4 = PoolWithTag;
  P = PoolWithTag;
  if( !PoolWithTag )
    RtlRaiseStatus(-1073741670);
  LOBYTE(v3) = 6;
  v5 = RtlInitializeSid(PoolWithTag, (SID_IDENTIFIER_AUTHORITY *)((char *)&AccessStatus + 4), v3);
  LODWORD(AccessStatus) = v5;
  if( v5 < 0 )
    RtlRaiseStatus(v5);
  v6 = 0;
  v26 = 0;
  while( v6 < 6 )
  {
    v7 = v34[v6];
    *RtlSubAuthoritySid(v4, v6++) = v7;
    v26 = v6;
  }
  v8 = RtlLengthSid(v4) + 20;
  v30 = v8;
  v9 = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v8, 0x64695555ui64);
  v10 = v9;
  v29 = v9;
  if( !v9 )
    RtlRaiseStatus(-1073741670);
  Acl = RtlCreateAcl(v9, v8, 2u);
  LODWORD(AccessStatus) = Acl;
  if( Acl < 0 )
    RtlRaiseStatus(Acl);
  v12 = RtlpAddKnownAce(v10, 2ui64, 0i64, 1ui64, v4, 0);
  LODWORD(AccessStatus) = v12;
  if( v12 < 0 )
    RtlRaiseStatus(v12);
  v13 = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  LODWORD(AccessStatus) = v13;
  if( v13 < 0 )
    RtlRaiseStatus(v13);
  v14 = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v10, 0);
  LODWORD(AccessStatus) = v14;
  if( v14 < 0 )
    RtlRaiseStatus(v14);
  LODWORD(PreviouslyGrantedAccess) = 0;
  if( !SeAccessCheck(
          SecurityDescriptor,
          &SubjectSecurityContext,
          0,
          1ui64,
          PreviouslyGrantedAccess,
          0i64,
          (GENERIC_MAPPING *)&ExpUuidSeedGenericMapping,
          1,
          &GrantedAccess,
          &AccessStatus) )
    RtlRaiseStatus(-1073741790);
  v24 = *(_DWORD *)Seed;
  v25 = *((_WORD *)Seed + 2);
  LODWORD(AccessStatus) = 0;
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v29 )
    ExFreePoolWithTag(v29, 0);
  if( !(_DWORD)AccessStatus )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    LODWORD(v16) = KeAbPreAcquire(&ExpUuidLock, 0i64, 0i64);
    v17 = v16;
    if( _interlockedbittestandset64((volatile signed __int32 *)&ExpUuidLock, 0i64) )
      ExfAcquirePushLockExclusiveEx(&ExpUuidLock, v16, &ExpUuidLock);
    if( v17 )
      v17[26] |= 1u;
    *(int *)((char *)&dword_140D2C2E4 + 2) = v24;
    word_140D2C2EA = v25;
    BYTE5(NlsMbCodePageTag) = (unsigned __int8)v24 >> 7 == 0;
    v18 = _InterlockedExchangeAdd64((volatile signed __int64 *)&ExpUuidLock, 0xFFFFFFFFFFFFFFFFui64);
    if( (v18 & 2) != 0 && (v18 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)&ExpUuidLock);
    KeAbPostRelease(&ExpUuidLock);
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
  }
  SeReleaseSubjectContext(&SubjectSecurityContext);
  return AccessStatus;
}

Referenced by: