ExpUuidSaveSequenceNumber

NTSTATUS __stdcall ExpUuidSaveSequenceNumber(UINT64 Sequence){
  int PersistedStateLocation; 
  INT64 v2; 
  VOID *a5; 
  INT64 a6; 
  INT64 a6a; 
  INT64 a6b; 
  INT64 v8; 
  INT64 v9; 
  int Data; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  WCHAR SourceString[256]; 

  KeyHandle = 0i64;
  Data = ExpUuidSequenceNumber;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  memset(SourceString, 0i64, 0x1FEu);
  LODWORD(a6) = 510;
  PersistedStateLocation = RtlGetPersistedStateLocation(
                             (WCHAR *)L"KernelExecutive",
                             0i64,
                             L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Executive",
                             0i64,
                             SourceString,
                             a6,
                             0i64);
  if( PersistedStateLocation >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, SourceString);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    PersistedStateLocation = ZwOpenKey(&KeyHandle, 0xC0000000ui64, &ObjectAttributes, v2, (INT64)a5, a6a, v8, v9);
    if( PersistedStateLocation >= 0 )
    {
      LODWORD(a6b) = 4;
      PersistedStateLocation = ZwSetValueKey(
                                 KeyHandle,
                                 (_UNICODE_STRING *)&ExpUuidSequenceNumberRegName,
                                 0i64,
                                 4ui64,
                                 &Data,
                                 a6b);
    }
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return PersistedStateLocation;
}

Referenced by: