ExpNtDeleteWnfStateData

INT64 __fastcall ExpNtDeleteWnfStateData(INT64 *a1, UINT64 *a2, INT64 a3){
  _ETHREAD *CurrentThread; 
  CHAR v5; 
  CHAR v6; 
  _WNF_STATE_NAME_STRUCT v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  int v10; 
  _EPROCESS *v11; 
  int v12; 
  INT64 v13; 
  int v15; 
  NTSTATUS v16; 
  INT64 v17; 
  int v18; 
  int v19; 
  _WNF_NAME_INSTANCE *NameInstance; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  int v22; 
  int v23; 
  _WNF_STATE_NAME_STRUCT StateName; 
  int v25[2]; 
  PVOID P; 
  void *Sid[2]; 
  INT64 CapturedScopeData[2]; 
  INT64 v29; 
  INT64 v30; 
  v23 = a3;
  StateName = 0i64;
  Sid[0] = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v5 = *((_BYTE *)KeGetCurrentThread() + 562);
  P = 0i64;
  ScopeInstance = 0i64;
  NameInstance = 0i64;
  v19 = 0;
  *(_OWORD *)CapturedScopeData = 0i64;
  v18 = ExpCaptureWnfStateName((const _WNF_STATE_NAME *)a1, &StateName, v5);
  if( v18 >= 0 )
  {
    v7 = StateName;
    v8 = (*(unsigned __int64 *)&StateName >> 4) & 3;
    v22 = (*(unsigned __int64 *)&StateName >> 4) & 3;
    v9 = (*(unsigned __int64 *)&StateName >> 6) & 0xF;
    v19 = (*(unsigned __int64 *)&StateName >> 6) & 0xF;
    v18 = ExpWnfCaptureScopeInstanceId(v9, a2, v6, Sid, (INT64)CapturedScopeData);
    if( v18 >= 0 )
    {
      if( v5 )
      {
        v10 = 0;
        if( a2 )
        {
          v18 = ExpWnfCheckCrossScopeAccess(v7);
          if( v18 < 0 )
            goto LABEL_21;
        }
      }
      else
      {
        v10 = 1;
      }
      if( v5 )
      {
        v29 = (INT64)KeGetCurrentThread();
        v11 = *(_EPROCESS **)(v29 + 184);
        v7 = StateName;
        LODWORD(v8) = v22;
        LODWORD(v9) = v19;
      }
      else
      {
        v29 = 0i64;
        v11 = (_EPROCESS *)PsInitialSystemProcess;
      }
      *(_QWORD *)v25 = v11;
      if( (_DWORD)v9 != 5
        || !v23
        || (v30 = *(_QWORD *)&v7 ^ 0x41C64E6DA3BC0074i64,
            LODWORD(v17) = 0,
            v15 = ExpCrossVmWnfPush(0x41C64E6DA3BC0074i64, 1ui64, (INT64)&v30, 0i64, 0i64, v17),
            v18 = v15,
            (int)(v15 + 0x80000000) < 0)
        || v15 == -1073741822 )
      {
        v18 = ExpWnfResolveScopeInstance((struct _EX_RUNDOWN_REF **)&ScopeInstance, *(__int64 *)v25, v29, v9, Sid[0]);
        if( v18 >= 0 )
        {
          v12 = ExpWnfLookupNameInstance(ScopeInstance, v7, &NameInstance);
          v18 = v12;
          if( v12 != -1073741772 || (_DWORD)v8 == 3 )
          {
            if( v12 >= 0 )
            {
              if( v10
                || (v18 = ExpWnfCheckCallerAccess(NameInstance->StateNameInfo.SecurityDescriptor, 2ui64), v18 >= 0) )
              {
                if( (_DWORD)v8 != 3 || NameInstance->CreatorProcess == *(_EPROCESS **)v25 )
                {
                  if( (*(_WORD *)&v7 & 0x400) == 0
                    || (v16 = ExpWnfDeletePermanentStateData((INT64)ScopeInstance, *(_QWORD *)&v7),
                        v18 = v16,
                        ((v16 + 0x80000000) & 0x80000000) != 0)
                    || v16 == -1073741772 )
                  {
                    ExpWnfDeleteStateData((INT64)NameInstance);
                    if( (_DWORD)v9 == 5 )
                    {
                      v29 = *(_QWORD *)&v7 ^ 0x41C64E6DA3BC0074i64;
                      LODWORD(v17) = 0;
                      ExpCrossVmWnfPush(v13, 0i64, (INT64)&v29, 0i64, 0i64, v17);
                    }
                    goto LABEL_20;
                  }
                }
                else
                {
                  v18 = -1073741790;
                }
              }
            }
          }
          else
          {
            v18 = ExpWnfLookupPermanentName(v7, (_WNF_STATE_NAME_REGISTRATION **)&P);
            if( v18 >= 0 )
            {
              if( v10 || (v18 = ExpWnfCheckCallerAccess(*((PVOID *)P + 2), 2ui64), v18 >= 0) )
              {
                if( (*(_WORD *)&v7 & 0x400) == 0
                  || (v18 = ExpWnfDeletePermanentStateData((INT64)ScopeInstance, *(_QWORD *)&v7), v18 == -1073741772) )
                {
LABEL_20:
                  v18 = 0;
                }
              }
            }
          }
        }
      }
    }
  }
LABEL_21:
  if( NameInstance )
    ExReleaseRundownProtection(&NameInstance->RunRef);
  if( ScopeInstance )
    ExReleaseRundownProtection(&ScopeInstance->RunRef);
  if( P )
    ExFreePoolWithTag(P, 0x20666E57u);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  ExpWnfReleaseCapturedScopeInstanceId(v19, (PVOID *)CapturedScopeData, v5);
  return(unsigned int)v18;
}

Referenced by: