PiUEventInitClientRegistrationContext

_WNF_STATE_NAME *__stdcall PiUEventInitClientRegistrationContext(){
  _ACL *v0; 
  VOID **PoolWithTag; 
  VOID **v2; 
  VOID **v3; 
  PSID v4; 
  NTSTATUS v5; 
  int v6; 
  int v7; 
  int v8; 
  unsigned int v9; 
  VOID **v10; 
  UINT64 v11; 
  void *v13; 
  UINT64 NewType; 
  _UNICODE_STRING CapName; 
  __int128 SecurityDescriptor[2]; 
  __int64 v17; 
  char CapabilitySid[48]; 
  char CapabilityGroupSid[48]; 

  *(_QWORD *)&CapName.Length = 2752552i64;
  v17 = 0i64;
  v0 = 0i64;
  CapName.Buffer = L"lpacPnpNotifications";
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x90ui64, 1500540496i64);
  v2 = PoolWithTag;
  if( PoolWithTag )
  {
    memset(PoolWithTag, 0i64, 0x90u);
    v3 = ExAllocatePoolWithTag(0x200ui64, 0x38ui64, 1500540496i64);
    v2[2] = v3;
    if( !v3 )
      goto LABEL_18;
    KeInitializeGuardedMutex((PKGUARDED_MUTEX)v3);
    *((_DWORD *)v2 + 33) = 4;
    v2[15] = v2 + 14;
    v2[14] = v2 + 14;
    *((_BYTE *)v2 + 140) = 1;
    v2[13] = v2 + 12;
    v2[12] = v2 + 12;
    if( RtlDeriveCapabilitySidsFromName(&CapName, CapabilityGroupSid, CapabilitySid) < 0 )
      goto LABEL_18;
    if( RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64) < 0 )
      goto LABEL_18;
    v4 = SeLocalSystemSid;
    if( RtlSetOwnerSecurityDescriptor(SecurityDescriptor, SeLocalSystemSid, 1u) < 0 )
      goto LABEL_18;
    v5 = RtlLengthSid((INT64)SeLowMandatorySid);
    v6 = RtlLengthSid((INT64)SeAllAppPackagesSid) + v5;
    v7 = RtlLengthSid((INT64)SeWorldSid) + v6;
    v8 = RtlLengthSid((INT64)v4) + v7;
    v9 = v8 + RtlLengthSid((INT64)CapabilitySid) + 48;
    v10 = ExAllocatePoolWithTag(1ui64, v9, 1500540496i64);
    v0 = (_ACL *)v10;
    if( !v10
      || RtlCreateAcl((PACL)v10, (_ACL)v9, 2ui64, v11) < 0
      || RtlpAddKnownAce(v0, 2ui64, 2ui64, 0x10000000ui64, SeLocalSystemSid, 0) < 0
      || RtlpAddKnownAce(v0, 2ui64, 2ui64, 1ui64, SeWorldSid, 0) < 0
      || RtlpAddKnownAce(v0, 2ui64, 2ui64, 1ui64, SeAllAppPackagesSid, 0) < 0
      || RtlpAddKnownAce(v0, 2ui64, 2ui64, 1ui64, SeLowMandatorySid, 0) < 0
      || RtlpAddKnownAce(v0, 2ui64, 2ui64, 1ui64, CapabilitySid, 0) < 0
      || RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v0, 0) < 0
      || (LODWORD(NewType) = 4,
          ZwCreateWnfStateName(
            (_WNF_STATE_NAME *)v2 + 11,
            WnfTemporaryStateName,
            WnfDataScopeMachine,
            0,
            0i64,
            NewType,
            SecurityDescriptor) < 0) )
    {
LABEL_18:
      v13 = v2[2];
      if( v13 )
        ExFreePoolWithTag(v13, 0x59706E50u);
      ExFreePoolWithTag(v2, 0x59706E50u);
      v2 = 0i64;
    }
    if( v0 )
      ExFreePoolWithTag(v0, 0x59706E50u);
  }
  return(_WNF_STATE_NAME *)v2;
}

Referenced by: