NtDeleteWnfStateName

NTSTATUS __stdcall NtDeleteWnfStateName(_WNF_STATE_NAME *StateName){
  _ETHREAD *CurrentThread; 
  _WNF_SCOPE_INSTANCE *v2; 
  int v3; 
  char v4; 
  __int64 bf_0; 
  unsigned __int64 v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  _BOOL8 v9; 
  _EPROCESS *Process; 
  int v11; 
  _WNF_NAME_INSTANCE *NameInstance; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  _WNF_STATE_NAME_STRUCT StateNamea; 
  VOID **StateNameRegistration; 
  _WNF_DATA_SCOPE DataScope[2]; 
  char PreviousMode; 
  int v19; 
  _EPROCESS *v20; 

  StateNamea._bf_0 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v19 = 0;
  StateNameRegistration = 0i64;
  v2 = 0i64;
  ScopeInstance = 0i64;
  NameInstance = 0i64;
  v3 = ExpCaptureWnfStateName(StateName, &StateNamea, PreviousMode);
  if( v3 >= 0 )
  {
    bf_0 = StateNamea._bf_0;
    v6 = (unsigned __int64)StateNamea._bf_0 >> 4;
    v7 = ((unsigned __int64)StateNamea._bf_0 >> 6) & 0xF;
    *(_QWORD *)DataScope = v7;
    v8 = ((unsigned __int64)StateNamea._bf_0 >> 4) & 3;
    if( (((unsigned __int64)StateNamea._bf_0 >> 4) & 3) == 0 )
    {
      v3 = -1073741811;
      goto LABEL_19;
    }
    v9 = v4 == 0;
    if( (_DWORD)v8 != 3 )
    {
      if( v4 )
      {
        v3 = ExpWnfLookupPermanentName(StateNamea, &StateNameRegistration);
        if( v3 < 0 )
          goto LABEL_19;
        v3 = ExpWnfCheckCallerAccess(StateNameRegistration[2], 0x10000ui64);
        if( v3 < 0 )
          goto LABEL_19;
        LODWORD(v9) = 1;
      }
      v3 = ExpWnfDeletePermanentName((_WNF_STATE_NAME_STRUCT)bf_0);
      if( v3 < 0 )
        goto LABEL_19;
      v19 = 1;
      SLODWORD(v7) = DataScope[0];
      v4 = PreviousMode;
    }
    if( v4 )
    {
      Process = KeGetCurrentThread()->ApcState.Process;
      bf_0 = StateNamea._bf_0;
    }
    else
    {
      Process = PsInitialSystemProcess;
    }
    v20 = Process;
    if( (_DWORD)v8 == 3 )
    {
      v3 = ExpWnfResolveScopeInstance(&ScopeInstance, Process, 0i64, (_WNF_DATA_SCOPE)v7, 0i64);
      v2 = ScopeInstance;
      if( v3 < 0 )
        goto LABEL_19;
    }
    else
    {
      v3 = 0;
      v2 = ExpWnfEnumerateScopeInstances((_WNF_DATA_SCOPE)v7, 0i64);
    }
    if( v2 )
    {
      v11 = v6 & 3;
      while( 1 )
      {
        v3 = ExpWnfLookupNameInstance(v2, (_WNF_STATE_NAME_STRUCT)bf_0, &NameInstance);
        if( v3 >= 0 )
        {
          if( !v9 )
          {
            v3 = ExpWnfCheckCallerAccess(NameInstance->StateNameInfo.SecurityDescriptor, 0x10000ui64);
            if( v3 < 0 )
              goto LABEL_19;
            LODWORD(v9) = 1;
          }
          if( v11 == 3i64 && NameInstance->CreatorProcess != v20 )
          {
            v3 = -1073741790;
            goto LABEL_19;
          }
          ExpWnfNotifyNameSubscribers(NameInstance, 0x10ui64, 1ui64, PreviousMode != 0);
          if( (unsigned int)ExpWnfDeleteNameInstance(v2, NameInstance, 1u) )
            NameInstance = 0i64;
          else
            v3 = -1073741772;
        }
        if( v11 != 3i64 )
        {
          if( NameInstance )
          {
            ExReleaseRundownProtection(&NameInstance->RunRef);
            NameInstance = 0i64;
          }
          v2 = ExpWnfEnumerateScopeInstances(DataScope[0], v2);
          if( v2 )
            continue;
        }
        break;
      }
    }
    if( (bf_0 & 0x400) != 0 )
      ExpWnfDeletePermanentStateData(0i64, (_WNF_STATE_NAME_STRUCT)bf_0);
  }
LABEL_19:
  if( v19 )
    v3 = 0;
  if( NameInstance )
    ExReleaseRundownProtection(&NameInstance->RunRef);
  if( v2 )
    ExReleaseRundownProtection(&v2->RunRef);
  if( StateNameRegistration )
    ExFreePoolWithTag(StateNameRegistration, 0x20666E57u);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v3;
}

Referenced by: