WmipSaveGuidSecurityDescriptor

NTSTATUS __stdcall WmipSaveGuidSecurityDescriptor(PUNICODE_STRING GuidName, PSECURITY_DESCRIPTOR SecurityDescriptor){
  VOID *PoolWithTag; 
  int v5; 
  unsigned int v6; 
  NTSTATUS PersistedStateLocation; 
  NTSTATUS v8; 
  UINT64 ValueLength; 
  UINT64 v11; 
  PoolWithTag = 0i64;
  v5 = RtlLengthSecurityDescriptor(SecurityDescriptor);
  v6 = 0;
  LODWORD(v11) = 0;
  while( 1 )
  {
    if( v6 )
    {
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, v6, 0x70696D57ui64);
      if( !PoolWithTag )
        return -1073741670;
    }
    LODWORD(ValueLength) = v6;
    PersistedStateLocation = RtlGetPersistedStateLocation(
                               (WCHAR *)L"ETWSecurityPath",
                               0i64,
                               0i64,
                               0i64,
                               PoolWithTag,
                               ValueLength,
                               &v11);
    v8 = PersistedStateLocation;
    if( PersistedStateLocation != -2147483643 )
      break;
    if( PoolWithTag )
    {
      ExFreePoolWithTag(PoolWithTag, 0);
      PoolWithTag = 0i64;
    }
    v6 = v11;
  }
  if( !PersistedStateLocation )
  {
    LODWORD(ValueLength) = v5;
    v8 = RtlWriteRegistryValue(
           0i64,
           (const WCHAR *)PoolWithTag,
           GuidName->Buffer,
           3ui64,
           SecurityDescriptor,
           ValueLength);
  }
  if( v8 == -1073741772 )
  {
    LODWORD(ValueLength) = v5;
    v8 = RtlWriteRegistryValue(2ui64, L"WMI\\Security", GuidName->Buffer, 3ui64, SecurityDescriptor, ValueLength);
  }
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return v8;
}

Referenced by: