NtDeleteWnfStateName

NTSTATUS __stdcall NtDeleteWnfStateName(_WNF_STATE_NAME *StateName){
  _ETHREAD *CurrentThread; 
  _WNF_SCOPE_INSTANCE *v2; 
  NTSTATUS v3; 
  CHAR v4; 
  _WNF_STATE_NAME_STRUCT v5; 
  unsigned __int64 v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  _BOOL8 v9; 
  _EPROCESS *v10; 
  int v11; 
  _WNF_NAME_INSTANCE *NameInstance; 
  _WNF_SCOPE_INSTANCE *ScopeInstance; 
  _WNF_STATE_NAME_STRUCT StateNamea; 
  PVOID P; 
  UINT64 v17; 
  CHAR v18; 
  int v19; 
  _EPROCESS *v20; 
  StateNamea = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v18 = *((_BYTE *)KeGetCurrentThread() + 562);
  v19 = 0;
  P = 0i64;
  v2 = 0i64;
  ScopeInstance = 0i64;
  NameInstance = 0i64;
  v3 = ExpCaptureWnfStateName(StateName, &StateNamea, v18);
  if( v3 >= 0 )
  {
    v5 = StateNamea;
    v6 = *(unsigned __int64 *)&StateNamea >> 4;
    v7 = (*(unsigned __int64 *)&StateNamea >> 6) & 0xF;
    v17 = v7;
    v8 = (*(unsigned __int64 *)&StateNamea >> 4) & 3;
    if( ((*(unsigned __int64 *)&StateNamea >> 4) & 3) == 0 )
    {
      v3 = -1073741811;
      goto LABEL_19;
    }
    v9 = v4 == 0;
    if( (_DWORD)v8 != 3 )
    {
      if( v4 )
      {
        v3 = ExpWnfLookupPermanentName(StateNamea, (_WNF_STATE_NAME_REGISTRATION **)&P);
        if( v3 < 0 )
          goto LABEL_19;
        v3 = ExpWnfCheckCallerAccess(*((PVOID *)P + 2), 0x10000ui64);
        if( v3 < 0 )
          goto LABEL_19;
        LODWORD(v9) = 1;
      }
      v3 = ExpWnfDeletePermanentName(*(_QWORD *)&v5);
      if( v3 < 0 )
        goto LABEL_19;
      v19 = 1;
      v7 = v17;
      v4 = v18;
    }
    if( v4 )
    {
      v10 = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
      v5 = StateNamea;
    }
    else
    {
      v10 = (_EPROCESS *)PsInitialSystemProcess;
    }
    v20 = v10;
    if( (_DWORD)v8 == 3 )
    {
      v3 = ExpWnfResolveScopeInstance((struct _EX_RUNDOWN_REF **)&ScopeInstance, (__int64)v10, 0i64, v7, 0i64);
      v2 = ScopeInstance;
      if( v3 < 0 )
        goto LABEL_19;
    }
    else
    {
      v3 = 0;
      v2 = (_WNF_SCOPE_INSTANCE *)ExpWnfEnumerateScopeInstances(v7, 0i64);
    }
    if( v2 )
    {
      v11 = v6 & 3;
      while( 1 )
      {
        v3 = ExpWnfLookupNameInstance(v2, v5, &NameInstance);
        if( v3 >= 0 )
        {
          if( !v9 )
          {
            v3 = ExpWnfCheckCallerAccess(NameInstance->StateNameInfo.SecurityDescriptor, 0x10000ui64);
            if( v3 < 0 )
              goto LABEL_19;
            LODWORD(v9) = 1;
          }
          if( v11 == 3i64 && NameInstance->CreatorProcess != v20 )
          {
            v3 = -1073741790;
            goto LABEL_19;
          }
          ExpWnfNotifyNameSubscribers((INT64)NameInstance, 0x10ui64, 1i64, v18 != 0);
          if( (unsigned int)ExpWnfDeleteNameInstance(v2, NameInstance, 1u) )
            NameInstance = 0i64;
          else
            v3 = -1073741772;
        }
        if( v11 != 3i64 )
        {
          if( NameInstance )
          {
            ExReleaseRundownProtection(&NameInstance->RunRef);
            NameInstance = 0i64;
          }
          v2 = (_WNF_SCOPE_INSTANCE *)ExpWnfEnumerateScopeInstances((unsigned int)v17, (EX_RUNDOWN_REF *)v2);
          if( v2 )
            continue;
        }
        break;
      }
    }
    if( (*(_WORD *)&v5 & 0x400) != 0 )
      ExpWnfDeletePermanentStateData(0i64, *(_QWORD *)&v5);
  }
LABEL_19:
  if( v19 )
    v3 = 0;
  if( NameInstance )
    ExReleaseRundownProtection(&NameInstance->RunRef);
  if( v2 )
    ExReleaseRundownProtection(&v2->RunRef);
  if( P )
    ExFreePoolWithTag(P, 0x20666E57u);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return v3;
}

Referenced by: