ExpWnfCaptureScopeInstanceId

INT64 __fastcall ExpWnfCaptureScopeInstanceId(INT64 a1, UINT64 *a2, CHAR a3, PVOID *a4, INT64 CapturedScopeData){
  PVOID *v5; 
  int v7; 
  UINT64 v8; 
  __int64 v9; 
  int v10; 
  int v11; 
  __int64 v12; 
  v5 = a4;
  LOBYTE(a4) = a3;
  if( !a2 )
  {
    *v5 = 0i64;
    return 0i64;
  }
  if( !(_DWORD)a1 )
    return(unsigned int)-1073741811;
  v7 = a1 - 1;
  if( v7 )
  {
    v11 = v7 - 1;
    if( !v11 )
    {
      v10 = SeCaptureSid(a2, a3, a3, a4);
      if( v10 >= 0 )
        *v5 = *(PVOID *)CapturedScopeData;
      return(unsigned int)v10;
    }
    if( v11 == 1 )
    {
      v10 = ObpReferenceObjectByHandleWithTag(
              (ULONG_PTR)a2,
              0,
              (__int64)PsProcessType,
              a3,
              0x20666E57u,
              CapturedScopeData,
              0i64,
              0i64);
      if( v10 >= 0 )
        *v5 = (PVOID)CapturedScopeData;
      return(unsigned int)v10;
    }
    return(unsigned int)-1073741811;
  }
  if( a3 )
  {
    v12 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)a2 < 0x7FFFFFFF0000i64 )
      v12 = (__int64)a2;
    v8 = *(unsigned int *)v12;
  }
  else
  {
    v8 = *(unsigned int *)a2;
  }
  *(_DWORD *)(CapturedScopeData + 8) = v8;
  LODWORD(v9) = MmGetSessionById(v8);
  *(_QWORD *)CapturedScopeData = v9;
  if( !v9 )
    return(unsigned int)-1073741811;
  *v5 = (PVOID)(CapturedScopeData + 8);
  return 0;
}

Referenced by: