ExpWnfPopulateStateData

INT64 __fastcall ExpWnfPopulateStateData(_WNF_NAME_INSTANCE *NameInstance){
  _WNF_STATE_NAME_STRUCT StateName; 
  unsigned int MaxStateSize; 
  UINT64 v5; 
  _WNF_STATE_DATA *PoolWithTag; 
  _WNF_STATE_NAME_STRUCT v7; 
  NTSTATUS v8; 
  unsigned int v9; 
  unsigned int ChangeStamp; 
  unsigned int DataSize; 
  EX_RUNDOWN_REF *v12; 
  UINT64 ExtensionTable; 
  int v14; 
  ULONG ResultLength; 
  struct _UNICODE_STRING ValueName; 
  __int64 v17; 
  char v18; 
  StateName = NameInstance->StateName;
  if( ((*(unsigned __int64 *)&StateName >> 6) & 0xF) == 5 )
  {
    v12 = ExpCrossVmIntExtensionHostGuest;
    v17 = *(_QWORD *)&StateName ^ 0x41C64E6DA3BC0074i64;
    ExtensionTable = ExGetExtensionTable(ExpCrossVmIntExtensionHostGuest);
    if( ExtensionTable )
    {
      v14 = (*(__int64(__fastcall **)(__int64 *, INT64(__fastcall *)(INT64, INT64, INT64, INT64, VOID *, size_t), _WNF_NAME_INSTANCE *))(ExtensionTable + 120))(
              &v17,
              ExpWnfPopulateStateDataRemoteCallback,
              NameInstance);
      ExReleaseExtensionTable(v12);
      if( v14 != -1073741822 )
      {
        if( v14 < 0 )
          return(unsigned int)v14;
        return 0i64;
      }
    }
  }
  if( NameInstance->StateData || !NameInstance->PermanentDataStore )
    return 0i64;
  MaxStateSize = NameInstance->StateNameInfo.MaxStateSize;
  v5 = MaxStateSize + 16;
  while( 1 )
  {
    PoolWithTag = (_WNF_STATE_DATA *)ExAllocatePoolWithTag(PagedPool, v5, 0x20666E57ui64);
    if( !PoolWithTag )
      return 3221225626i64;
    v7 = NameInstance->StateName;
    *(_QWORD *)&ValueName.Length = 2228224i64;
    ValueName.Buffer = (wchar_t *)&v18;
    ExpWnfComposeValueName(v7, &ValueName);
    ResultLength = MaxStateSize + 16;
    v8 = ZwQueryValueKey(
           NameInstance->PermanentDataStore,
           &ValueName,
           KeyValuePartialInformation,
           PoolWithTag,
           MaxStateSize + 16,
           &ResultLength);
    v9 = v8;
    if( v8 == -1073741772 )
    {
      *(_QWORD *)&PoolWithTag->DataSize = 0i64;
LABEL_9:
      PoolWithTag->Header = (_WNF_NODE_HEADER)1050884;
      ChangeStamp = PoolWithTag->ChangeStamp;
      PoolWithTag->AllocatedSize = MaxStateSize;
      NameInstance->CurrentChangeStamp = ChangeStamp;
      NameInstance->StateData = PoolWithTag;
      return 0i64;
    }
    if( v8 != -1073741789 )
      break;
    ExFreePoolWithTag(PoolWithTag, 0x20666E57u);
    v5 = ResultLength;
    MaxStateSize = ResultLength - 16;
  }
  if( v8 >= 0 )
  {
    if( PoolWithTag->AllocatedSize == 3 )
    {
      DataSize = PoolWithTag->DataSize;
      if( DataSize >= 4 )
      {
        PoolWithTag->DataSize = DataSize - 4;
        goto LABEL_9;
      }
    }
    v9 = -1073741823;
  }
  ExFreePoolWithTag(PoolWithTag, 0x20666E57u);
  return v9;
}

Referenced by: