NtCreateWnfStateName

INT64 __fastcall NtCreateWnfStateName(
        _WNF_STATE_NAME *StateName,
        _WNF_STATE_NAME_LIFETIME NameLifetime,
        _WNF_DATA_SCOPE DataScope,
        INT64 PersistData,
        const _WNF_TYPE_ID *TypeId,
        INT64 MaximumStateSize,
        VOID *SecurityDescriptor,
        INT64 a8){
  UINT8 v8; 
  _WNF_STATE_NAME *v11; 
  __int64 v12; 
  _ETHREAD *CurrentThread; 
  INT8 v14; 
  _WNF_STATE_NAME_STRUCT v15; 
  _EPROCESS *v16; 
  int v18; 
  PSECURITY_DESCRIPTOR SecurityDescriptora; 
  _WNF_STATE_NAME_STRUCT StateNamea; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  const _WNF_TYPE_ID *v22; 
  _WNF_NAME_INSTANCE *NameInstance[4]; 
  _WNF_STATE_NAME_REGISTRATION StateInfo; 
  __int128 v25; 
  v8 = PersistData;
  v11 = StateName;
  v12 = (__int64)TypeId;
  NameInstance[1] = (_WNF_NAME_INSTANCE *)SecurityDescriptor;
  v25 = 0i64;
  StateNamea = 0i64;
  NameInstance[0] = 0i64;
  *(&StateInfo.MaxStateSize + 1) = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v14 = *((_BYTE *)KeGetCurrentThread() + 562);
  ScopeInstance = 0i64;
  SecurityDescriptora = 0i64;
  v22 = TypeId;
  if( !v14 )
  {
    v18 = SeCaptureSecurityDescriptor(SecurityDescriptor, 0, PagedPool, 1u, &SecurityDescriptora);
    if( v18 < 0 )
      goto LABEL_18;
LABEL_3:
    ExpWnfSpecializeSecurityDescriptor(SecurityDescriptora);
    if( (unsigned int)NameLifetime > WnfTemporaryStateName
      || NameLifetime == WnfWellKnownStateName
      || (unsigned int)DataScope > WnfDataScopePhysicalMachine
      || v8 && ((DataScope & 0xFFFFFFFB) != 0 || NameLifetime != WnfPermanentStateName)
      || (unsigned int)MaximumStateSize > 0x1000
      || DataScope == WnfDataScopeProcess && NameLifetime == WnfTemporaryStateName
      || DataScope == WnfDataScopePhysicalMachine )
    {
      v18 = -1073741811;
    }
    else if( NameLifetime == WnfTemporaryStateName
           || SeSinglePrivilegeCheck(*(_QWORD *)&SeCreatePermanentPrivilege, v14) )
    {
      v18 = ExpWnfGenerateStateName(&StateNamea, NameLifetime, DataScope, v8);
      if( v18 >= 0 )
      {
        v15 = StateNamea;
        *v11 = (_WNF_STATE_NAME)(*(_QWORD *)&StateNamea ^ 0x41C64E6DA3BC0074i64);
        StateInfo.MaxStateSize = MaximumStateSize;
        StateInfo.TypeId = v22;
        StateInfo.SecurityDescriptor = (_SECURITY_DESCRIPTOR *)SecurityDescriptora;
        if( NameLifetime == WnfTemporaryStateName )
        {
          if( v14 )
          {
            v16 = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
            v15 = StateNamea;
          }
          else
          {
            v16 = (_EPROCESS *)PsInitialSystemProcess;
          }
          v18 = ExpWnfResolveScopeInstance(
                  (struct _EX_RUNDOWN_REF **)&ScopeInstance,
                  (__int64)v16,
                  0i64,
                  DataScope,
                  0i64);
          if( v18 >= 0 )
          {
            v18 = ExpWnfCreateNameInstance(ScopeInstance, v15, &StateInfo, v16, NameInstance);
            if( v18 >= 0 )
              ExReleaseRundownProtection(&NameInstance[0]->RunRef);
          }
        }
        else
        {
          v18 = ((__int64(__fastcall *)(_QWORD, _QWORD))ExpWnfRegisterPermanentName)(v15, &StateInfo);
        }
      }
    }
    else
    {
      v18 = -1073741727;
    }
    goto LABEL_18;
  }
  if( (unsigned __int64)StateName >= 0x7FFFFFFF0000i64 )
    StateName = (_WNF_STATE_NAME *)0x7FFFFFFF0000i64;
  LOBYTE(StateName->Data[0]) = StateName->Data[0];
  HIBYTE(StateName->Data[1]) = HIBYTE(StateName->Data[1]);
  if( TypeId )
  {
    if( (unsigned __int64)TypeId >= 0x7FFFFFFF0000i64 )
      v12 = 0x7FFFFFFF0000i64;
    v25 = *(_OWORD *)v12;
    v22 = (const _WNF_TYPE_ID *)&v25;
  }
  if( !SecurityDescriptor )
  {
    v18 = -1073741819;
    goto LABEL_18;
  }
  v18 = SeCaptureSecurityDescriptor(SecurityDescriptor, v14, PagedPool, 1u, &SecurityDescriptora);
  if( v18 >= 0 )
    goto LABEL_3;
LABEL_18:
  if( ScopeInstance )
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  if( SecurityDescriptora && SecurityDescriptora != SecurityDescriptor )
    SeReleaseSecurityDescriptor(SecurityDescriptora, v14, 1u);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return(unsigned int)v18;
}

Referenced by: