NtSetUuidSeed

NTSTATUS __stdcall NtSetUuidSeed(PCHAR Seed){
  VOID **PoolWithTag; 
  VOID **Sid; 
  int v4; 
  unsigned int v5; 
  int v6; 
  int *v7; 
  unsigned int v8; 
  _ACL *v9; 
  UINT64 v10; 
  _ACL *v11; 
  int Acl; 
  int v13; 
  int v14; 
  int v15; 
  _ETHREAD *CurrentThread; 
  _BYTE *v17; 
  _BYTE *v18; 
  char v19; 
  _KPROCESSOR_MODE AccessMode; 
  int AccessStatus; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  int v25; 
  __int16 v26; 
  unsigned int v27; 
  unsigned int GrantedAccess; 
  PVOID P; 
  PVOID v30; 
  unsigned int v31; 
  _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; 
  char SecurityDescriptor[32]; 
  __int64 v34; 
  int v35[6]; 

  AccessStatus = 0;
  memset(&SubjectSecurityContext, 0, sizeof(SubjectSecurityContext));
  v35[0] = 80;
  v35[1] = 521322694;
  v35[2] = 906040134;
  v35[3] = -430256637;
  v35[4] = 1525148216;
  v35[5] = -843743134;
  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  GrantedAccess = 0;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v34 = 0i64;
  v30 = 0i64;
  SeCaptureSubjectContext((INT64)&SubjectSecurityContext);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x20ui64, 1684624725i64);
  Sid = PoolWithTag;
  P = PoolWithTag;
  if( !PoolWithTag )
    RtlRaiseStatus(-1073741670);
  v4 = RtlInitializeSid(PoolWithTag, &IdentifierAuthority, 6u);
  AccessStatus = v4;
  if( v4 < 0 )
    RtlRaiseStatus(v4);
  v5 = 0;
  v27 = 0;
  while( v5 < 6 )
  {
    v6 = v35[v5];
    LODWORD(v7) = RtlSubAuthoritySid((INT64)Sid, v5);
    *v7 = v6;
    v27 = ++v5;
  }
  v8 = RtlLengthSid((INT64)Sid) + 20;
  v31 = v8;
  v9 = (_ACL *)ExAllocatePoolWithTag(1ui64, v8, 1684624725i64);
  v11 = v9;
  v30 = v9;
  if( !v9 )
    RtlRaiseStatus(-1073741670);
  Acl = RtlCreateAcl(v9, (_ACL)v8, 2ui64, v10);
  AccessStatus = Acl;
  if( Acl < 0 )
    RtlRaiseStatus(Acl);
  v13 = RtlpAddKnownAce(v11, 2ui64, 0i64, 1ui64, Sid, 0);
  AccessStatus = v13;
  if( v13 < 0 )
    RtlRaiseStatus(v13);
  v14 = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  AccessStatus = v14;
  if( v14 < 0 )
    RtlRaiseStatus(v14);
  v15 = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v11, 0);
  AccessStatus = v15;
  if( v15 < 0 )
    RtlRaiseStatus(v15);
  LOBYTE(AccessMode) = 1;
  if( !(unsigned __int8)SeAccessCheck(
                           SecurityDescriptor,
                           &SubjectSecurityContext,
                           0,
                           1,
                           0,
                           0i64,
                           (PGENERIC_MAPPING)&ExpUuidSeedGenericMapping,
                           AccessMode,
                           &GrantedAccess,
                           &AccessStatus) )
    RtlRaiseStatus(-1073741790);
  v25 = *(_DWORD *)Seed;
  v26 = *((_WORD *)Seed + 2);
  AccessStatus = 0;
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v30 )
    ExFreePoolWithTag(v30, 0);
  if( !AccessStatus )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v17 = KeAbPreAcquire(&stru_140CEC740, 0i64, 0i64);
    v18 = v17;
    if( _interlockedbittestandset64((volatile signed __int32 *)&stru_140CEC740, 0i64) )
      ExfAcquirePushLockExclusiveEx(&stru_140CEC740, v17, &stru_140CEC740);
    if( v18 )
      v18[26] |= 1u;
    *(int *)((char *)&dword_140D2C2E4 + 2) = v25;
    word_140D2C2EA = v26;
    BYTE5(NlsMbCodePageTag) = (unsigned __int8)v25 >> 7 == 0;
    v19 = _InterlockedExchangeAdd64(&stru_140CEC740._bf_0, 0xFFFFFFFFFFFFFFFFui64);
    if( (v19 & 2) != 0 && (v19 & 4) == 0 )
      ExfTryToWakePushLock(&stru_140CEC740);
    KeAbPostRelease(&stru_140CEC740);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  }
  SeReleaseSubjectContext(&SubjectSecurityContext);
  return AccessStatus;
}

Referenced by: