MiGenerateSecureCookie

UINT64 __stdcall MiGenerateSecureCookie(){
  struct _KPRCB *CurrentPrcb; 
  unsigned __int64 v1; 
  unsigned __int64 v2; 
  UINT64 v3; 
  CurrentPrcb = KeGetCurrentPrcb();
  v1 = *((unsigned int *)CurrentPrcb + 2894) ^ *((unsigned int *)CurrentPrcb + 8100) ^ KUSER_SHARED_DATA.SystemTime.High1Time ^ __rdtsc() ^ ((unsigned __int64)KUSER_SHARED_DATA.SystemTime.LowPart << 32);
  v2 = (unsigned __int64)(unsigned int)ExGenRandom(0i64) << 32;
  v3 = (v2 | (unsigned int)ExGenRandom(0i64)) ^ v1;
  if( !v3 )
    return 1i64;
  return v3;
}

Referenced by:

MiInitializeVadSecuring