ExpWnfCaptureScopeInstanceId

NTSTATUS __stdcall ExpWnfCaptureScopeInstanceId(
        _WNF_DATA_SCOPE DataScope,
        VOID *ScopeInstanceId,
        VOID *PreviousMode,
        VOID **CapturedScopeInstanceId,
        VOID **CapturedScopeData){
  VOID **v5; 
  VOID *v6; 
  __int32 v8; 
  UINT64 v9; 
  VOID *SessionById; 
  int v11; 
  __int32 v12; 
  __int64 v13; 
  UINT64 Tag; 

  v5 = CapturedScopeInstanceId;
  LOBYTE(CapturedScopeInstanceId) = (_BYTE)PreviousMode;
  v6 = ScopeInstanceId;
  if( !ScopeInstanceId )
  {
    *v5 = 0i64;
    return 0;
  }
  if( DataScope == WnfDataScopeSystem )
    return -1073741811;
  v8 = DataScope - 1;
  if( v8 )
  {
    v12 = v8 - 1;
    if( !v12 )
    {
      LOBYTE(ScopeInstanceId) = (_BYTE)PreviousMode;
      v11 = SeCaptureSid(v6, (INT64)ScopeInstanceId, (CHAR)PreviousMode, (INT64)CapturedScopeInstanceId);
      if( v11 >= 0 )
        *v5 = *CapturedScopeData;
      return v11;
    }
    if( v12 == 1 )
    {
      LODWORD(Tag) = 543583831;
      v11 = ObpReferenceObjectByHandleWithTag(
              ScopeInstanceId,
              0i64,
              (_OBJECT_TYPE *)PsProcessType,
              (CHAR)PreviousMode,
              Tag,
              CapturedScopeData,
              0i64,
              0i64);
      if( v11 >= 0 )
        *v5 = CapturedScopeData;
      return v11;
    }
    return -1073741811;
  }
  if( (_BYTE)PreviousMode )
  {
    v13 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)ScopeInstanceId < 0x7FFFFFFF0000i64 )
      v13 = (__int64)ScopeInstanceId;
    v9 = *(unsigned int *)v13;
  }
  else
  {
    v9 = *(unsigned int *)ScopeInstanceId;
  }
  *((_DWORD *)CapturedScopeData + 2) = v9;
  SessionById = MmGetSessionById(v9);
  *CapturedScopeData = SessionById;
  if( !SessionById )
    return -1073741811;
  *v5 = CapturedScopeData + 1;
  return 0;
}

Referenced by: