ExpInitFullProcessSecurityInfo

UINT64 __stdcall ExpInitFullProcessSecurityInfo(_RTL_RUN_ONCE *RunOnce, PVOID Parameter, PVOID *Context){
  NTSTATUS v4; 
  ULONG ResultLength; 
  void *KeyHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[8]; 
  unsigned int Size; 
  UINT8 Size_4; 
  memset((INT64)KeyValueInformation, 0i64);
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  KeyHandle = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"tv";
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  ResultLength = 0;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v4 = ZwOpenKey(&KeyHandle, 1u, &ObjectAttributes);
  if( v4 >= 0 )
  {
    v4 = ZwQueryValueKey(
           KeyHandle,
           &stru_140C04740,
           KeyValuePartialInformation,
           KeyValueInformation,
           0x54u,
           &ResultLength);
    if( v4 >= 0 )
    {
      if( Size > 0x44 )
      {
        v4 = -1073741789;
      }
      else
      {
        memmove(&ExpFullProcessInformationSid, &Size_4, Size);
        *Context = &ExpFullProcessInformationSid;
      }
    }
    ZwClose(KeyHandle);
  }
  return v4 >= 0;
}

Referenced by: