MiGenerateSecureCookie
UINT64 __stdcall MiGenerateSecureCookie(){
struct _KPRCB *CurrentPrcb;
unsigned __int64 v1;
unsigned __int64 v2;
UINT64 v3;
CurrentPrcb = KeGetCurrentPrcb();
v1 = *((unsigned int *)CurrentPrcb + 2894) ^ *((unsigned int *)CurrentPrcb + 8100) ^ KUSER_SHARED_DATA.SystemTime.High1Time ^ __rdtsc() ^ ((unsigned __int64)KUSER_SHARED_DATA.SystemTime.LowPart << 32);
v2 = (unsigned __int64)(unsigned int)ExGenRandom(0i64) << 32;
v3 = (v2 | (unsigned int)ExGenRandom(0i64)) ^ v1;
if( !v3 )
return 1i64;
return v3;
}Referenced by:
MiInitializeVadSecuring