PiAuGetDriverDataDirectorySecurityObject

NTSTATUS __stdcall PiAuGetDriverDataDirectorySecurityObject(CHAR **a1){
  VOID **v2; 
  unsigned int v3; 
  VOID **PoolWithTag; 
  UINT64 v5; 
  _ACL *v6; 
  int Acl; 
  VOID *v8; 
  unsigned int v9; 
  size_t v10; 
  VOID **v11; 
  __int128 SecurityDescriptor[2]; 
  __int64 v14; 
  UINT64 BufferLength; 

  v14 = 0i64;
  v2 = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v3 = 4
     * (*((unsigned __int8 *)SeLocalSystemSid + 1)
      + *((unsigned __int8 *)SeAliasAdminsSid + 1)
      + *((unsigned __int8 *)SeExports->SeUserModeDriversSid + 1))
     + 56;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v3, 538996816i64);
  v6 = (_ACL *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  Acl = RtlCreateAcl((PACL)PoolWithTag, (_ACL)v3, 2ui64, v5);
  if( Acl >= 0 )
  {
    v8 = SeLocalSystemSid;
    Acl = RtlAddAccessAllowedAceEx(v6, 2ui64, 3ui64, 0x10000000, SeLocalSystemSid);
    if( Acl >= 0 )
    {
      Acl = RtlAddAccessAllowedAceEx(v6, 2ui64, 3ui64, 0x10000000, SeAliasAdminsSid);
      if( Acl >= 0 )
      {
        Acl = RtlAddAccessAllowedAceEx(v6, 2ui64, 3ui64, 0x10000000, SeExports->SeUserModeDriversSid);
        if( Acl >= 0 )
        {
          Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
          if( Acl >= 0 )
          {
            Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v6, 0);
            if( Acl >= 0 )
            {
              Acl = RtlSetOwnerSecurityDescriptor(SecurityDescriptor, v8, 0);
              if( Acl >= 0 )
              {
                Acl = RtlSetGroupSecurityDescriptor(SecurityDescriptor, v8, 0);
                if( Acl >= 0 )
                {
                  if( RtlValidSecurityDescriptor(SecurityDescriptor)
                    && (v9 = RtlLengthSecurityDescriptor((INT64)SecurityDescriptor),
                        LODWORD(BufferLength) = v9,
                        v9 >= 0x28) )
                  {
                    v10 = v9;
                    v11 = ExAllocatePoolWithTag(1ui64, v9, 538996816i64);
                    v2 = v11;
                    if( v11 )
                    {
                      memset(v11, 0i64, v10);
                      Acl = RtlAbsoluteToSelfRelativeSD(SecurityDescriptor, v2, &BufferLength);
                      if( Acl >= 0 )
                      {
                        *a1 = (CHAR *)v2;
                        v2 = 0i64;
                      }
                    }
                    else
                    {
                      Acl = -1073741670;
                    }
                  }
                  else
                  {
                    Acl = -1073741595;
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  ExFreePoolWithTag(v6, 0);
  if( v2 )
    ExFreePoolWithTag(v2, 0);
  return Acl;
}

Referenced by: