WmipCreateGuidObject

__int64 __fastcall WmipCreateGuidObject(__int128 *a1, DWORD a2, _OWORD *a3, _QWORD *a4){
  __int64 v8; 
  WCHAR v9; 
  int GuidSecurityDescriptor; 
  __int128 v11; 
  __int128 v12; 
  PVOID v13; 
  __int128 v14; 
  __int128 v15; 
  INT64 v16; 
  __int64 v18; 
  UINT64 v19; 
  PVOID P; 
  INT64 DestinationString; 
  struct _UNICODE_STRING DestinationString_8; 
  __int128 v23; 
  __int64 v24; 
  int v25; 
  int v26; 
  PVOID v27; 
  __int64 v28; 
  INT64 result[4]; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int64 v31[28]; 
  P = 0i64;
  DestinationString_8 = 0i64;
  memset((INT64)result, 0i64);
  memset((INT64)v31, 0i64);
  v8 = *((_QWORD *)a1 + 2);
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString_8, (PCWSTR)(*(_QWORD *)(v8 + 8) + 18i64), v9);
  GuidSecurityDescriptor = WmipGetGuidSecurityDescriptor(&DestinationString_8, &P);
  if( GuidSecurityDescriptor >= 0 )
  {
    v11 = a1[1];
    v23 = *a1;
    v12 = a1[2];
    v13 = P;
    v26 = HIDWORD(v11);
    v24 = 0i64;
    v28 = *((_QWORD *)&v12 + 1);
    v27 = P;
    v25 = 640;
    GuidSecurityDescriptor = SeCreateAccessState(
                               (_ACCESS_STATE *)result,
                               (_AUX_ACCESS_DATA *)v31,
                               a2,
                               (_GENERIC_MAPPING *)&WmipGenericMapping);
    if( GuidSecurityDescriptor >= 0 )
    {
      v14 = *(_OWORD *)&SubjectContext.ClientToken;
      v15 = *(_OWORD *)&SubjectContext.PrimaryToken;
      SubjectContext = WmipSystemSubjectContext;
      GuidSecurityDescriptor = ObCreateObjectEx(
                                 0,
                                 WmipGuidObjectType,
                                 (__int64)&v23,
                                 0,
                                 v18,
                                 168,
                                 0,
                                 0,
                                 &DestinationString,
                                 0i64);
      if( GuidSecurityDescriptor >= 0 )
      {
        v16 = DestinationString;
        memset(DestinationString, 0i64);
        KeInitializeEvent((_KEVENT *)v16, NotificationEvent, 0);
        LODWORD(v19) = 0;
        *(_DWORD *)(v16 + 112) = 4096;
        *(_DWORD *)(v16 + 144) = 4096;
        *(_OWORD *)(v16 + 24) = *a3;
        GuidSecurityDescriptor = ObInsertObjectEx((PVOID)v16, (ACCESS_STATE *)result, a2, 0i64, v19, 0i64, 0i64);
        if( GuidSecurityDescriptor >= 0 )
        {
          *a4 = v16;
          GuidSecurityDescriptor = 0;
        }
      }
      *(_OWORD *)&SubjectContext.ClientToken = v14;
      *(_OWORD *)&SubjectContext.PrimaryToken = v15;
      SepDeleteAccessState((ACCESS_STATE *)result);
      SeReleaseSubjectContext(&SubjectContext);
    }
    if( v13 && v13 != (PVOID)WmipDefaultAccessSd )
      ExFreePoolWithTag(v13, 0);
  }
  return(unsigned int)GuidSecurityDescriptor;
}

Referenced by: