PiDevCfgGetKeySecurityDescriptor

NTSTATUS __stdcall PiDevCfgGetKeySecurityDescriptor(
        VOID *KeyHandle,
        VOID **KeySecurityDescriptor,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  _ACL *v10; 
  VOID **v11; 
  NTSTATUS SecurityObject; 
  int GroupSecurityDescriptor; 
  unsigned int v15; 
  VOID **PoolWithTag; 
  unsigned int v17; 
  PACL v18; 
  unsigned int v19; 
  VOID **v20; 
  UINT64 v21; 
  unsigned int v22; 
  size_t v23; 
  VOID **v24; 
  UINT64 *LengthNeeded; 
  unsigned __int8 DaclPresent; 
  UINT8 GroupDefaulted[3]; 
  _DWORD NumberOfBytes[3]; 
  PACL Dacl; 
  PVOID Ace; 
  PVOID AceList; 
  __int128 AbsoluteSecurityDescriptor[2]; 
  __int64 v33; 
  char SecurityDescriptor[56]; 

  *KeySecurityDescriptor = 0i64;
  v33 = 0i64;
  memset(NumberOfBytes, 0, sizeof(NumberOfBytes));
  DaclPresent = 0;
  Dacl = 0i64;
  Ace = 0i64;
  v10 = 0i64;
  AceList = 0i64;
  memset(AbsoluteSecurityDescriptor, 0, sizeof(AbsoluteSecurityDescriptor));
  v11 = 0i64;
  SecurityObject = ZwQuerySecurityObject(
                     (UINT64)KeyHandle,
                     2i64,
                     (UINT64)SecurityDescriptor,
                     0x34ui64,
                     (UINT64)NumberOfBytes);
  GroupSecurityDescriptor = SecurityObject;
  if( SecurityObject == -1073741789 )
    return -1073741720;
  if( SecurityObject >= 0 )
  {
    GroupSecurityDescriptor = RtlGetGroupSecurityDescriptor(
                                SecurityDescriptor,
                                (VOID **)&NumberOfBytes[1],
                                GroupDefaulted);
    if( GroupSecurityDescriptor >= 0 )
    {
      if( !*(_QWORD *)&NumberOfBytes[1] )
        return -1073741722;
      if( !RtlEqualSid(*(PVOID *)&NumberOfBytes[1], PiDevCfgNullSid) )
        return -1073741720;
      v15 = 240;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 0xF0ui64, 1667526736i64);
      if( PoolWithTag )
      {
        while( 1 )
        {
          GroupSecurityDescriptor = ZwQuerySecurityObject(
                                      (UINT64)KeyHandle,
                                      4i64,
                                      (UINT64)PoolWithTag,
                                      v15,
                                      (UINT64)NumberOfBytes);
          if( GroupSecurityDescriptor != -1073741789 )
            break;
          if( NumberOfBytes[0] <= v15 )
          {
            GroupSecurityDescriptor = -1073741595;
            break;
          }
          v15 = NumberOfBytes[0];
          ExFreePoolWithTag(PoolWithTag, 0);
          PoolWithTag = ExAllocatePoolWithTag(1ui64, v15, 1667526736i64);
          if( !PoolWithTag )
            goto LABEL_13;
        }
        v17 = 0;
        if( GroupSecurityDescriptor < 0 )
          goto LABEL_14;
        GroupSecurityDescriptor = RtlGetDaclSecurityDescriptor(PoolWithTag, &DaclPresent, &Dacl, GroupDefaulted);
        if( GroupSecurityDescriptor < 0 )
          goto LABEL_14;
        if( !DaclPresent || (v18 = Dacl) == 0i64 )
        {
          GroupSecurityDescriptor = -1073741275;
          goto LABEL_14;
        }
        if( Dacl->AceCount )
        {
          do
          {
            GroupSecurityDescriptor = RtlGetAce(v18, v17, &Ace);
            if( GroupSecurityDescriptor < 0 )
              goto LABEL_14;
            if( !*(_BYTE *)Ace
              && (*((_DWORD *)Ace + 1) & 0xF003F) == 983103
              && RtlEqualSid((char *)Ace + 8, SeLocalSystemSid) )
            {
              *KeySecurityDescriptor = PoolWithTag;
              return GroupSecurityDescriptor;
            }
          }
          while( ++v17 < v18->AceCount );
        }
        v19 = RtlLengthSid((INT64)SeLocalSystemSid) + v18->AclSize + 8;
        v20 = ExAllocatePoolWithTag(1ui64, v19, 1667526736i64);
        v10 = (_ACL *)v20;
        if( v20 )
        {
          GroupSecurityDescriptor = RtlCreateAcl((PACL)v20, (_ACL)v19, 2ui64, v21);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          GroupSecurityDescriptor = RtlGetAce(v18, 0i64, &AceList);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          LODWORD(LengthNeeded) = v18->AclSize - 8;
          GroupSecurityDescriptor = RtlAddAce(v10, 2ui64, 0i64, AceList, (UINT64)LengthNeeded);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          GroupSecurityDescriptor = RtlpAddKnownAce(v10, 2ui64, 2ui64, 0xF003Fui64, SeLocalSystemSid, 0);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          GroupSecurityDescriptor = RtlCreateSecurityDescriptor(AbsoluteSecurityDescriptor, 1ui64);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          GroupSecurityDescriptor = RtlSetDaclSecurityDescriptor(AbsoluteSecurityDescriptor, 1u, v10, 0);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          if( RtlValidSecurityDescriptor(AbsoluteSecurityDescriptor) )
          {
            v22 = RtlLengthSecurityDescriptor((INT64)AbsoluteSecurityDescriptor);
            NumberOfBytes[1] = v22;
            if( v22 >= 0x28 )
            {
              v23 = v22;
              v24 = ExAllocatePoolWithTag(1ui64, v22, 1667526736i64);
              v11 = v24;
              if( v24 )
              {
                memset(v24, 0i64, v23);
                GroupSecurityDescriptor = RtlAbsoluteToSelfRelativeSD(
                                            AbsoluteSecurityDescriptor,
                                            v11,
                                            (UINT64 *)&NumberOfBytes[1]);
                if( GroupSecurityDescriptor >= 0 )
                {
                  *KeySecurityDescriptor = v11;
                  v11 = 0i64;
                }
                goto LABEL_14;
              }
              goto LABEL_13;
            }
          }
          GroupSecurityDescriptor = -1073741595;
LABEL_14:
          if( PoolWithTag && PoolWithTag != (VOID **)SecurityDescriptor )
            ExFreePoolWithTag(PoolWithTag, 0);
          if( v11 )
            ExFreePoolWithTag(v11, 0);
          if( v10 )
            ExFreePoolWithTag(v10, 0);
          return GroupSecurityDescriptor;
        }
      }
LABEL_13:
      GroupSecurityDescriptor = -1073741670;
      goto LABEL_14;
    }
  }
  return GroupSecurityDescriptor;
}

Referenced by: