ExpWnfGetPermanentPerUserDataStoreHandle

NTSTATUS __stdcall ExpWnfGetPermanentPerUserDataStoreHandle(PSID Sid, PHANDLE KeyHandle){
  NTSTATUS result; 
  unsigned __int16 v5; 
  unsigned __int16 v6; 
  VOID **PoolWithTag; 
  VOID **v8; 
  int v9; 
  UINT64 CreateOptions; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING UnicodeString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 StringLength; 

  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  *(_DWORD *)(&UnicodeString.MaximumLength + 1) = 0;
  LODWORD(StringLength) = 0;
  result = RtlLengthSidAsUnicodeString(Sid, &StringLength);
  if( result >= 0 )
  {
    v5 = StringLength;
    v6 = StringLength + 82;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)(StringLength + 82), 543583831i64);
    v8 = PoolWithTag;
    if( PoolWithTag )
    {
      *(_QWORD *)&Destination.Length = 0i64;
      Destination.MaximumLength = v6;
      Destination.Buffer = (wchar_t *)PoolWithTag;
      RtlAppendUnicodeToString(&Destination, (WCHAR *)L"\\Registry\\User\\");
      UnicodeString.Length = 0;
      UnicodeString.MaximumLength = v5;
      UnicodeString.Buffer = &Destination.Buffer[(unsigned __int64)Destination.Length >> 1];
      v9 = RtlConvertSidToUnicodeString(&UnicodeString, Sid, 0);
      if( v9 >= 0 )
      {
        Destination.Length += UnicodeString.Length;
        RtlAppendUnicodeToString(&Destination, (WCHAR *)L"_Classes\\NotificationData");
        LODWORD(CreateOptions) = 0;
        ObjectAttributes.ObjectName = &Destination;
        ObjectAttributes.Length = 48;
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        v9 = ZwCreateKey(KeyHandle, 0xF003Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
      }
      ExFreePoolWithTag(v8, 0x20666E57u);
      return v9;
    }
    else
    {
      return -1073741670;
    }
  }
  return result;
}

Referenced by: