PopCreateTimebrokerServiceSid

NTSTATUS __stdcall PopCreateTimebrokerServiceSid(){
  unsigned int v0; 
  VOID **PoolWithTag; 
  VOID **v2; 
  int v3; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 

  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  v0 = RtlLengthRequiredSid(6ui64);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v0, 1734960208i64);
  v2 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  memset(PoolWithTag, 0i64, v0);
  v3 = RtlInitializeSid(v2, &IdentifierAuthority, 6u);
  if( v3 >= 0 )
  {
    *((_DWORD *)v2 + 2) = 80;
    *((_DWORD *)v2 + 3) = 410965207;
    *((_DWORD *)v2 + 4) = -1744070425;
    *((_DWORD *)v2 + 5) = 1717734767;
    *((_DWORD *)v2 + 6) = -1973635081;
    *((_DWORD *)v2 + 7) = -539001157;
    *(&stru_140C23628 + 288) = v2;
    v2 = 0i64;
  }
  if( v2 )
    ExFreePoolWithTag(v2, 0x67696450u);
  return v3;
}

Referenced by: