NtCreateWnfStateName

NTSTATUS __stdcall NtCreateWnfStateName(
        _WNF_STATE_NAME *StateName,
        _WNF_STATE_NAME_LIFETIME NameLifetime,
        _WNF_DATA_SCOPE DataScope,
        UINT8 PersistData,
        _WNF_TYPE_ID *TypeId,
        UINT64 MaximumStateSize,
        VOID *SecurityDescriptor){
  _WNF_STATE_NAME *v10; 
  __int64 v11; 
  _ETHREAD *CurrentThread; 
  char PreviousMode; 
  __int64 bf_0; 
  _EPROCESS *Process; 
  INT64 v17; 
  INT64 v18; 
  int v19; 
  VOID *ScopeInstanceId; 
  _WNF_STATE_NAME_STRUCT StateNamea; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  _WNF_TYPE_ID *v23; 
  _WNF_NAME_INSTANCE *NameInstance[4]; 
  _WNF_STATE_NAME_REGISTRATION StateInfo; 
  __int128 v26; 

  v10 = StateName;
  v11 = (__int64)TypeId;
  NameInstance[1] = (_WNF_NAME_INSTANCE *)SecurityDescriptor;
  v26 = 0i64;
  StateNamea._bf_0 = 0i64;
  NameInstance[0] = 0i64;
  *(&StateInfo.MaxStateSize + 1) = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  LOBYTE(v18) = PreviousMode;
  ScopeInstance = 0i64;
  ScopeInstanceId = 0i64;
  v23 = TypeId;
  if( !PreviousMode )
  {
    v19 = SeCaptureSecurityDescriptor(SecurityDescriptor, 0, PagedPool, 1u, &ScopeInstanceId, v17, v18);
    if( v19 < 0 )
      goto LABEL_18;
LABEL_3:
    ExpWnfSpecializeSecurityDescriptor(ScopeInstanceId);
    if( (unsigned int)NameLifetime > WnfTemporaryStateName
      || NameLifetime == WnfWellKnownStateName
      || (unsigned int)DataScope > WnfDataScopePhysicalMachine
      || PersistData && ((DataScope & 0xFFFFFFFB) != 0 || NameLifetime != WnfPermanentStateName)
      || (unsigned int)MaximumStateSize > 0x1000
      || DataScope == WnfDataScopeProcess && NameLifetime == WnfTemporaryStateName
      || DataScope == WnfDataScopePhysicalMachine )
    {
      v19 = -1073741811;
    }
    else if( NameLifetime == WnfTemporaryStateName
           || SeSinglePrivilegeCheck(*(_QWORD *)&SeCreatePermanentPrivilege, PreviousMode) )
    {
      v19 = ExpWnfGenerateStateName(&StateNamea, NameLifetime, DataScope, PersistData);
      if( v19 >= 0 )
      {
        bf_0 = StateNamea._bf_0;
        *v10 = (_WNF_STATE_NAME)(StateNamea._bf_0 ^ 0x41C64E6DA3BC0074i64);
        StateInfo.MaxStateSize = MaximumStateSize;
        StateInfo.TypeId = v23;
        StateInfo.SecurityDescriptor = (_SECURITY_DESCRIPTOR *)ScopeInstanceId;
        if( NameLifetime == WnfTemporaryStateName )
        {
          if( PreviousMode )
          {
            Process = KeGetCurrentThread()->ApcState.Process;
            bf_0 = StateNamea._bf_0;
          }
          else
          {
            Process = PsInitialSystemProcess;
          }
          v19 = ExpWnfResolveScopeInstance(&ScopeInstance, Process, 0i64, DataScope, 0i64);
          if( v19 >= 0 )
          {
            v19 = ExpWnfCreateNameInstance(
                    ScopeInstance,
                    (_WNF_STATE_NAME_STRUCT)bf_0,
                    &StateInfo,
                    Process,
                    NameInstance);
            if( v19 >= 0 )
              ExReleaseRundownProtection(&NameInstance[0]->RunRef);
          }
        }
        else
        {
          v19 = ExpWnfRegisterPermanentName((_WNF_STATE_NAME_STRUCT)bf_0, &StateInfo);
        }
      }
    }
    else
    {
      v19 = -1073741727;
    }
    goto LABEL_18;
  }
  if( (unsigned __int64)StateName >= 0x7FFFFFFF0000i64 )
    StateName = (_WNF_STATE_NAME *)0x7FFFFFFF0000i64;
  LOBYTE(StateName->Data[0]) = StateName->Data[0];
  HIBYTE(StateName->Data[1]) = HIBYTE(StateName->Data[1]);
  if( TypeId )
  {
    if( (unsigned __int64)TypeId >= 0x7FFFFFFF0000i64 )
      v11 = 0x7FFFFFFF0000i64;
    v26 = *(_OWORD *)v11;
    v23 = (_WNF_TYPE_ID *)&v26;
  }
  if( !SecurityDescriptor )
  {
    v19 = -1073741819;
    goto LABEL_18;
  }
  v19 = SeCaptureSecurityDescriptor(SecurityDescriptor, PreviousMode, PagedPool, 1u, &ScopeInstanceId, v17, v18);
  if( v19 >= 0 )
    goto LABEL_3;
LABEL_18:
  if( ScopeInstance )
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  if( ScopeInstanceId && ScopeInstanceId != SecurityDescriptor )
    SeReleaseSecurityDescriptor(ScopeInstanceId, PreviousMode, 1u);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v19;
}

Referenced by: