ExpUuidLoadSequenceNumber

INT64 __fastcall ExpUuidLoadSequenceNumber(UINT64 *Sequence){
  int PersistedStateLocation; 
  WCHAR v2; 
  PULONG ResultLength; 
  ULONG v5; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[4]; 
  int v10; 
  int v11; 
  int v12; 
  WCHAR SourceString[256]; 
  v5 = 0;
  KeyHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  memset((INT64)SourceString, 0i64);
  LODWORD(ResultLength) = 510;
  PersistedStateLocation = RtlGetPersistedStateLocation(
                             (WCHAR *)L"KernelExecutive",
                             0i64,
                             L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Executive",
                             0i64,
                             SourceString,
                             (UINT64)ResultLength,
                             0i64);
  if( PersistedStateLocation >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, SourceString, v2);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    PersistedStateLocation = ZwOpenKey(&KeyHandle, 0x80000000, &ObjectAttributes);
    if( PersistedStateLocation >= 0 )
    {
      PersistedStateLocation = ZwQueryValueKey(
                                 KeyHandle,
                                 (PUNICODE_STRING)&ExpUuidSequenceNumberRegName,
                                 KeyValuePartialInformation,
                                 KeyValueInformation,
                                 0x14u,
                                 &v5);
      if( PersistedStateLocation >= 0 )
      {
        if( v10 == 4 && v11 == 4 )
          ExpUuidSequenceNumber = v12;
        else
          PersistedStateLocation = -1073741823;
      }
    }
  }
  if( KeyHandle )
    ZwClose(KeyHandle);
  return(unsigned int)PersistedStateLocation;
}

Referenced by: