CmpGetVirtualizationID

NTSTATUS __stdcall CmpGetVirtualizationID(_UNICODE_STRING *SidString){
  __int64 v1; 
  __int64 v2; 
  VOID *v4; 
  int v5; 
  UINT64 v6; 
  VOID **PoolWithTag; 
  int a2; 
  _UNICODE_STRING UnicodeString; 
  char UserSid[80]; 

  a2 = 0;
  v2 = v1;
  UnicodeString = 0i64;
  memset(UserSid, 0i64, 0x44u);
  v4 = (VOID *)CmpEffectiveTokenForSubject((INT64 *)v2, &a2);
  if( a2 == 2 && *(int *)(v2 + 8) < 2 )
    v4 = *(VOID **)(v2 + 16);
  SeQueryUserSidToken(v4, UserSid, 0x44ui64, 0i64);
  v5 = RtlConvertSidToUnicodeString(&UnicodeString, UserSid, 1u);
  if( v5 >= 0 )
  {
    v6 = (unsigned __int16)(UnicodeString.Length + 20);
    SidString->MaximumLength = v6;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v6, 1700154691i64);
    SidString->Buffer = (wchar_t *)PoolWithTag;
    if( PoolWithTag )
    {
      RtlCopyUnicodeString(SidString, &UnicodeString);
      RtlAppendUnicodeToString(SidString, (WCHAR *)L"_Classes");
    }
    else
    {
      v5 = -1073741670;
    }
  }
  RtlFreeAnsiString(&UnicodeString);
  return v5;
}

Referenced by: