PopCreateHiberFileSecurityDescriptor

VOID *__stdcall PopCreateHiberFileSecurityDescriptor(){
  _ACL *v0; 
  _ACL *v1; 
  VOID **PoolWithTag; 
  unsigned __int8 *Sid; 
  _DWORD *v4; 
  __int64 v5; 
  VOID **v6; 
  UINT64 v7; 
  VOID **v8; 
  NTSTATUS SecurityDescriptor; 
  _ACL *v10; 
  PVOID Ace; 

  v0 = 0i64;
  WORD2(Ace) = 256;
  LODWORD(Ace) = 0;
  v1 = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0xCui64, 1919052136i64);
  Sid = (unsigned __int8 *)PoolWithTag;
  if( !PoolWithTag )
    return v0;
  if( RtlInitializeSid(PoolWithTag, (_SID_IDENTIFIER_AUTHORITY *)&Ace, 1u) >= 0 )
  {
    LODWORD(v4) = RtlSubAuthoritySid((INT64)Sid, 0i64);
    *v4 = 0;
    v5 = 4 * (unsigned int)Sid[1] + 24;
    if( (unsigned int)v5 >= 4 * (unsigned int)Sid[1] + 16 )
    {
      v6 = ExAllocatePoolWithTag(1ui64, (unsigned int)v5, 1919052136i64);
      v1 = (_ACL *)v6;
      if( v6 )
      {
        if( RtlCreateAcl((PACL)v6, (_ACL)(unsigned int)v5, 2ui64, v7) >= 0
          && RtlpAddKnownAce(v1, 2ui64, 0i64, 0x10000ui64, Sid, 0) >= 0 )
        {
          Ace = 0i64;
          RtlGetAce(v1, 0i64, &Ace);
          *((_BYTE *)Ace + 1) |= 2u;
          v8 = ExAllocatePoolWithTag(1ui64, v5 + 40, 1919052136i64);
          v0 = (_ACL *)v8;
          if( v8 )
          {
            memmove(v8 + 5, v1, v5);
            SecurityDescriptor = RtlCreateSecurityDescriptor(v0, 1ui64);
            v10 = v0;
            if( SecurityDescriptor >= 0 )
            {
              if( RtlSetDaclSecurityDescriptor(v0, 1u, v0 + 5, 0) >= 0 )
                goto LABEL_10;
              v10 = v0;
            }
            ExFreePoolWithTag(v10, 0);
          }
        }
      }
    }
  }
LABEL_10:
  ExFreePoolWithTag(Sid, 0);
  if( v1 )
    ExFreePoolWithTag(v1, 0);
  return v0;
}

Referenced by: