PnpGetEnumSecurityDescriptor

VOID **PnpGetEnumSecurityDescriptor(){
  VOID **v0; 
  _DWORD *v1; 
  _DWORD *v2; 
  _DWORD *v3; 
  _DWORD *v4; 
  _DWORD *v5; 
  NTSTATUS v6; 
  int v7; 
  unsigned int v8; 
  VOID **PoolWithTag; 
  UINT64 v10; 
  _ACL *v11; 
  unsigned int v12; 
  size_t v13; 
  VOID **v14; 
  VOID **v15; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  _SID_IDENTIFIER_AUTHORITY v18; 
  _SID_IDENTIFIER_AUTHORITY v19; 
  __int128 SecurityDescriptor[2]; 
  __int64 v21; 
  char Sid[12]; 
  INT64 v23; 
  INT64 v24; 
  char Owner[20]; 

  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_DWORD *)v18.Value = 0;
  *(_DWORD *)v19.Value = 0;
  v21 = 0i64;
  *(_WORD *)&v18.Value[4] = 768;
  v0 = 0i64;
  *(_WORD *)&v19.Value[4] = 256;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  if( RtlInitializeSid(Sid, &IdentifierAuthority, 1u) >= 0 )
  {
    LODWORD(v1) = RtlSubAuthoritySid((INT64)Sid, 0i64);
    *v1 = 18;
    if( RtlValidSid(Sid) )
    {
      if( RtlInitializeSid(&v23, &v18, 1u) >= 0 )
      {
        LODWORD(v2) = RtlSubAuthoritySid((INT64)&v23, 0i64);
        *v2 = 4;
        if( RtlValidSid(&v23) )
        {
          if( RtlInitializeSid(&v24, &v19, 1u) >= 0 )
          {
            LODWORD(v3) = RtlSubAuthoritySid((INT64)&v24, 0i64);
            *v3 = 0;
            if( RtlValidSid(&v24) )
            {
              if( RtlInitializeSid(Owner, &IdentifierAuthority, 2u) >= 0 )
              {
                LODWORD(v4) = RtlSubAuthoritySid((INT64)Owner, 0i64);
                *v4 = 32;
                LODWORD(v5) = RtlSubAuthoritySid((INT64)Owner, 1ui64);
                *v5 = 544;
                if( RtlValidSid(Owner) )
                {
                  v6 = RtlLengthSid((INT64)&v24);
                  v7 = RtlLengthSid((INT64)&v23) + v6;
                  v8 = RtlLengthSid((INT64)Sid) + 32 + v7;
                  PoolWithTag = ExAllocatePoolWithTag(1ui64, v8, 1380994640i64);
                  v11 = (_ACL *)PoolWithTag;
                  if( PoolWithTag )
                  {
                    if( RtlCreateAcl((PACL)PoolWithTag, (_ACL)v8, 2ui64, v10) >= 0
                      && RtlpAddKnownAce(v11, 2ui64, 2ui64, 0xF003Fui64, Sid, 0) >= 0
                      && RtlpAddKnownAce(v11, 2ui64, 2ui64, 0x20000ui64, &v23, 0) >= 0
                      && RtlpAddKnownAce(v11, 2ui64, 2ui64, 0x20019ui64, &v24, 0) >= 0
                      && RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64) >= 0
                      && RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v11, 0) >= 0
                      && RtlSetOwnerSecurityDescriptor(SecurityDescriptor, Owner, 1u) >= 0
                      && RtlSetGroupSecurityDescriptor(SecurityDescriptor, Owner, 1u) >= 0 )
                    {
                      WORD1(SecurityDescriptor[0]) |= 0x1400u;
                      if( RtlValidSecurityDescriptor(SecurityDescriptor) )
                      {
                        v12 = RtlLengthSecurityDescriptor((INT64)SecurityDescriptor);
                        *(_DWORD *)IdentifierAuthority.Value = v12;
                        if( v12 >= 0x28 )
                        {
                          v13 = v12;
                          v14 = ExAllocatePoolWithTag(1ui64, v12, 1380994640i64);
                          v15 = v14;
                          if( v14 )
                          {
                            memset(v14, 0i64, v13);
                            if( RtlAbsoluteToSelfRelativeSD(
                                   SecurityDescriptor,
                                   v15,
                                   (UINT64 *)IdentifierAuthority.Value) >= 0 )
                            {
                              v0 = v15;
                              v15 = 0i64;
                            }
                            if( v15 )
                              ExFreePoolWithTag(v15, 0);
                          }
                        }
                      }
                    }
                    ExFreePoolWithTag(v11, 0);
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  return v0;
}

Referenced by: