CmpGetVirtualizationID

NTSTATUS __stdcall CmpGetVirtualizationID(UNICODE_STRING *SidString){
  __int64 v1; 
  __int64 v2; 
  VOID *v4; 
  int v5; 
  UINT64 v6; 
  wchar_t *PoolWithTag; 
  UNICODE_STRING *v8; 
  int a2; 
  struct _UNICODE_STRING UnicodeString; 
  char Sid[80]; 
  a2 = 0;
  v2 = v1;
  UnicodeString = 0i64;
  memset((INT64)Sid, 0i64);
  v4 = (VOID *)CmpEffectiveTokenForSubject((INT64 *)v2, &a2);
  if( a2 == 2 && *(int *)(v2 + 8) < 2 )
    v4 = *(VOID **)(v2 + 16);
  SeQueryUserSidToken(v4, Sid, 0x44ui64, 0i64);
  v5 = RtlConvertSidToUnicodeString(&UnicodeString, Sid, 1u);
  if( v5 >= 0 )
  {
    v6 = (unsigned __int16)(UnicodeString.Length + 20);
    SidString->MaximumLength = v6;
    PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v6, 0x65564D43ui64);
    SidString->Buffer = PoolWithTag;
    if( PoolWithTag )
    {
      RtlCopyUnicodeString(SidString, &UnicodeString, v8);
      RtlAppendUnicodeToString(SidString, (PWCHAR)L"_Classes");
    }
    else
    {
      v5 = -1073741670;
    }
  }
  RtlFreeAnsiString(&UnicodeString);
  return v5;
}

Referenced by: