RtlpSysVolTakeOwnership

VOID __stdcall RtlpSysVolTakeOwnership(_UNICODE_STRING *DirectoryName){
  NTSTATUS v2; 
  VOID *v3; 
  UINT64 ShareAccess; 
  UINT64 OpenOptions; 
  void *TokenHandle; 
  VOID *FileHandle[2]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 SecurityDescriptor[2]; 
  __int64 v10; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _TOKEN_PRIVILEGES NewState; 
  __int16 Owner; 
  int v14; 
  __int16 v15; 
  int v16; 
  int v17; 

  TokenHandle = 0i64;
  FileHandle[0] = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v10 = 0i64;
  IoStatusBlock = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  if( NtOpenProcessTokenEx(0xFFFFFFFFFFFFFFFFui64, 40i64, 512i64, (UINT64)&TokenHandle) >= 0 )
  {
    FileHandle[1] = (VOID *)9;
    NewState.Privileges[0].Luid = (_LUID)9i64;
    NewState.PrivilegeCount = 1;
    NewState.Privileges[0].Attributes = 2;
    if( NtAdjustPrivilegesToken((UINT64)TokenHandle, 0, (UINT64)&NewState, 16i64, 0i64, 0i64) >= 0 )
    {
      ObjectAttributes.RootDirectory = 0i64;
      LODWORD(OpenOptions) = 33;
      ObjectAttributes.Length = 48;
      ObjectAttributes.Attributes = 576;
      ObjectAttributes.ObjectName = DirectoryName;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      LODWORD(ShareAccess) = 7;
      if( NtOpenFile(FileHandle, 0x180000ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions) >= 0 )
      {
        RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
        v14 = 0;
        v15 = 1280;
        Owner = 513;
        v16 = 32;
        v17 = 544;
        v2 = RtlSetOwnerSecurityDescriptor(SecurityDescriptor, &Owner, 0);
        v3 = FileHandle[0];
        if( v2 >= 0 )
        {
          NtSetSecurityObject((UINT64)FileHandle[0], 1ui64, (INT64)SecurityDescriptor);
          v3 = FileHandle[0];
        }
        NtClose((UINT64)v3);
      }
    }
    NtClose((UINT64)TokenHandle);
  }
}

Referenced by: