PiAuCreateStandardSecurityObject

NTSTATUS __stdcall PiAuCreateStandardSecurityObject(_PI_AU_USER_SIDS *UserSids){
  _ACL *v2; 
  VOID **v3; 
  unsigned int v4; 
  _QWORD *v5; 
  __int64 *v6; 
  int Acl; 
  __int64 v8; 
  __int64 v9; 
  _BYTE *v10; 
  __int64 v11; 
  __int64 v12; 
  unsigned int v13; 
  __int64 *v14; 
  __int64 v15; 
  VOID **PoolWithTag; 
  UINT64 v17; 
  unsigned int v18; 
  VOID **v19; 
  unsigned int v20; 
  size_t v21; 
  VOID **v22; 
  PVOID *v23; 
  unsigned int BufferLength[2]; 
  _BYTE SecurityDescriptor[40]; 
  __int64 v27; 
  _QWORD v28[22]; 

  LOWORD(BufferLength[1]) = 1280;
  BufferLength[0] = 0;
  v27 = 0i64;
  v2 = 0i64;
  v3 = 0i64;
  memset(v28, 0i64, 0xA8u);
  v4 = 0;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v5 = v28;
  v6 = PiAuSwDeviceCreateSidSubAuthorities;
  do
  {
    Acl = PiAuAllocateAndInitializeSid(
            (VOID **)&v28[v4],
            (_SID_IDENTIFIER_AUTHORITY *)BufferLength,
            *(unsigned int *)v6);
    if( Acl < 0 )
      goto LABEL_42;
    v8 = *(_QWORD *)SecurityDescriptor;
    v9 = 0i64;
    if( *(_DWORD *)v6 )
    {
      v10 = (_BYTE *)*v5;
      do
      {
        *(_DWORD *)&v10[4 * v9 + 8] = *((_DWORD *)PiAuSwDeviceCreateSidSubAuthorities + v8 + v9 + 1);
        v9 = (unsigned int)(v9 + 1);
      }
      while( (unsigned int)v9 < *(_DWORD *)v6 );
    }
    if( !RtlValidSid((_BYTE *)*v5) )
    {
      Acl = -1073741595;
LABEL_42:
      v11 = 21i64;
      goto LABEL_30;
    }
    ++v4;
    v6 = (__int64 *)((char *)v6 + 28);
    *(_QWORD *)SecurityDescriptor = v8 + 7;
    ++v5;
  }
  while( v4 < 0x15 );
  v11 = 21i64;
  v12 = 21i64;
  v13 = 4
      * (*(unsigned __int8 *)(*((_QWORD *)UserSids + 6) + 1i64)
       + *(unsigned __int8 *)(*(_QWORD *)UserSids + 1i64)
       + *(unsigned __int8 *)(*((_QWORD *)UserSids + 4) + 1i64)
       + *(unsigned __int8 *)(*((_QWORD *)UserSids + 5) + 1i64)
       + *(unsigned __int8 *)(*((_QWORD *)UserSids + 3) + 1i64)
       + *(unsigned __int8 *)(*((_QWORD *)UserSids + 2) + 1i64))
      + 104;
  v14 = v28;
  do
  {
    v15 = *v14++;
    v13 += 4 * *(unsigned __int8 *)(v15 + 1) + 16;
    --v12;
  }
  while( v12 );
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v13, 538996816i64);
  v2 = (_ACL *)PoolWithTag;
  if( PoolWithTag )
  {
    Acl = RtlCreateAcl((PACL)PoolWithTag, (_ACL)v13, 2ui64, v17);
    if( Acl >= 0 )
    {
      Acl = RtlAddAccessAllowedAceEx(v2, 2ui64, 0i64, 131559, *((VOID **)UserSids + 2));
      if( Acl >= 0 )
      {
        Acl = RtlAddAccessDeniedAceEx(v2, 2ui64, 0i64, 0xF01FFui64, *((VOID **)UserSids + 3));
        if( Acl >= 0 )
        {
          Acl = RtlAddAccessAllowedAceEx(v2, 2ui64, 0i64, 983551, *(VOID **)UserSids);
          if( Acl >= 0 )
          {
            Acl = RtlAddAccessAllowedAceEx(v2, 2ui64, 0i64, 131365, *((VOID **)UserSids + 4));
            if( Acl >= 0 )
            {
              Acl = RtlAddAccessAllowedAceEx(v2, 2ui64, 0i64, 64, *((VOID **)UserSids + 5));
              if( Acl >= 0 )
              {
                Acl = RtlAddAccessAllowedAceEx(v2, 2ui64, 0i64, 64, *((VOID **)UserSids + 6));
                if( Acl >= 0 )
                {
                  v18 = 0;
                  v19 = (VOID **)v28;
                  while( 1 )
                  {
                    Acl = RtlAddAccessAllowedAceEx(v2, 2ui64, 0i64, 128, *v19);
                    if( Acl < 0 )
                      break;
                    ++v18;
                    ++v19;
                    if( v18 >= 0x15 )
                    {
                      Acl = RtlCreateSecurityDescriptor(&SecurityDescriptor[8], 1ui64);
                      if( Acl >= 0 )
                      {
                        Acl = RtlSetDaclSecurityDescriptor(&SecurityDescriptor[8], 1u, v2, 0);
                        if( Acl >= 0 )
                        {
                          Acl = RtlSetOwnerSecurityDescriptor(&SecurityDescriptor[8], *(VOID **)UserSids, 0);
                          if( Acl >= 0 )
                          {
                            Acl = RtlSetGroupSecurityDescriptor(&SecurityDescriptor[8], *(VOID **)UserSids, 0);
                            if( Acl >= 0 )
                            {
                              if( RtlValidSecurityDescriptor(&SecurityDescriptor[8])
                                && (v20 = RtlLengthSecurityDescriptor((INT64)&SecurityDescriptor[8]),
                                    BufferLength[0] = v20,
                                    v20 >= 0x28) )
                              {
                                v21 = v20;
                                v22 = ExAllocatePoolWithTag(1ui64, v20, 538996816i64);
                                v3 = v22;
                                if( !v22 )
                                  goto LABEL_39;
                                memset(v22, 0i64, v21);
                                Acl = RtlAbsoluteToSelfRelativeSD(&SecurityDescriptor[8], v3, (UINT64 *)BufferLength);
                                if( Acl >= 0 )
                                {
                                  qword_140C50A68 = v3;
                                  v3 = 0i64;
                                }
                              }
                              else
                              {
                                Acl = -1073741595;
                              }
                            }
                          }
                        }
                      }
                      break;
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  else
  {
LABEL_39:
    Acl = -1073741670;
  }
LABEL_30:
  v23 = (PVOID *)v28;
  do
  {
    if( *v23 )
      ExFreePoolWithTag(*v23, 0);
    ++v23;
    --v11;
  }
  while( v11 );
  if( v2 )
    ExFreePoolWithTag(v2, 0);
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  return Acl;
}

Referenced by: