ExpUuidLoadSequenceNumber

NTSTATUS __stdcall ExpUuidLoadSequenceNumber(UINT64 *Sequence){
  int PersistedStateLocation; 
  INT64 v2; 
  VOID *a5; 
  VOID *a5a; 
  INT64 a6; 
  INT64 a6a; 
  INT64 v8; 
  INT64 v9; 
  UINT64 ResultLength; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[4]; 
  int v15; 
  int v16; 
  int v17; 
  WCHAR SourceString[256]; 

  LODWORD(ResultLength) = 0;
  KeyHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  memset(SourceString, 0i64, 0x1FEu);
  LODWORD(a6) = 510;
  PersistedStateLocation = RtlGetPersistedStateLocation(
                             (WCHAR *)L"KernelExecutive",
                             0i64,
                             L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Executive",
                             0i64,
                             SourceString,
                             a6,
                             0i64);
  if( PersistedStateLocation >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, SourceString);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    PersistedStateLocation = ZwOpenKey(&KeyHandle, 0x80000000ui64, &ObjectAttributes, v2, (INT64)a5, a6a, v8, v9);
    if( PersistedStateLocation >= 0 )
    {
      LODWORD(a5a) = 20;
      PersistedStateLocation = ZwQueryValueKey(
                                 KeyHandle,
                                 (_UNICODE_STRING *)&ExpUuidSequenceNumberRegName,
                                 KeyValuePartialInformation,
                                 KeyValueInformation,
                                 (UINT64)a5a,
                                 &ResultLength);
      if( PersistedStateLocation >= 0 )
      {
        if( v15 == 4 && v16 == 4 )
          ExpUuidSequenceNumber = v17;
        else
          PersistedStateLocation = -1073741823;
      }
    }
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return PersistedStateLocation;
}

Referenced by: