ExpWnfGetCurrentScopeInstance

NTSTATUS __stdcall ExpWnfGetCurrentScopeInstance(
        _EPROCESS *Process,
        _ETHREAD *Thread,
        _WNF_DATA_SCOPE DataScope,
        PVOID *ScopeInstance,
        UINT64 *ScopeInstanceSize,
        UINT64 *ImplicitScope){
  NTSTATUS v6; 
  _EPROCESS *v7; 
  __int32 v8; 
  __int32 v9; 
  bool v11; 

  v6 = 0;
  v7 = Process;
  if( DataScope == WnfDataScopeSystem )
    goto LABEL_13;
  v8 = DataScope - 1;
  if( v8 )
  {
    v9 = v8 - 1;
    if( !v9 )
      return ExpWnfQueryCurrentUserSID(Process, Thread, ScopeInstance, ScopeInstanceSize, ImplicitScope);
    if( v9 == 1 )
    {
      v11 = KeGetCurrentThread()->ApcStateIndex == 1;
      *(_DWORD *)ImplicitScope = !v11;
      if( v11 )
        v7 = KeGetCurrentThread()->ApcState.Process;
      *ScopeInstance = v7;
      *(_DWORD *)ScopeInstanceSize = 8;
      return v6;
    }
LABEL_13:
    *(_DWORD *)ScopeInstanceSize = 0;
    *(_DWORD *)ImplicitScope = 1;
    return v6;
  }
  v11 = KeGetCurrentThread()->ApcStateIndex == 1;
  *(_DWORD *)ImplicitScope = !v11;
  if( v11 )
    v7 = KeGetCurrentThread()->ApcState.Process;
  *(_DWORD *)ScopeInstance = PsGetProcessSessionId((INT64)v7);
  *(_DWORD *)ScopeInstanceSize = 4;
  return v6;
}

Referenced by: