PiAuGetStateDirectorySecurityObject

INT64 __fastcall PiAuGetStateDirectorySecurityObject(CHAR **a1){
  VOID *v2; 
  int v3; 
  int v4; 
  UINT32 v5; 
  struct _ACL *PoolWithTag; 
  ACL *v7; 
  int Acl; 
  PSID v9; 
  VOID *v10; 
  unsigned int v11; 
  VOID *v12; 
  __int128 SecurityDescriptor[2]; 
  __int64 v15; 
  UINT64 BufferLength; 
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v15 = 0i64;
  v2 = 0i64;
  v3 = RtlLengthSid(SeExports->SeUserModeDriversSid);
  v4 = RtlLengthSid(SeAliasAdminsSid) + v3;
  v5 = RtlLengthSid(SeLocalSystemSid) + 48 + 2 * v4;
  PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v5, 0x20207050ui64);
  v7 = PoolWithTag;
  if( PoolWithTag )
  {
    Acl = RtlCreateAcl(PoolWithTag, v5, 2u);
    if( Acl >= 0 )
    {
      v9 = SeLocalSystemSid;
      Acl = RtlpAddKnownAce(v7, 2ui64, 3ui64, 0x10000000ui64, SeLocalSystemSid, 0);
      if( Acl >= 0 )
      {
        v10 = SeAliasAdminsSid;
        Acl = RtlpAddKnownAce(v7, 2ui64, 3ui64, 0x80000000ui64, SeAliasAdminsSid, 0);
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v7, 2ui64, 2ui64, 0x20ui64, v10, 0);
          if( Acl >= 0 )
          {
            Acl = RtlpAddKnownAce(v7, 2ui64, 3ui64, 0x80000000ui64, SeExports->SeUserModeDriversSid, 0);
            if( Acl >= 0 )
            {
              Acl = RtlpAddKnownAce(v7, 2ui64, 2ui64, 0x20ui64, SeExports->SeUserModeDriversSid, 0);
              if( Acl >= 0 )
              {
                Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
                if( Acl >= 0 )
                {
                  Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v7, 0);
                  if( Acl >= 0 )
                  {
                    Acl = RtlSetOwnerSecurityDescriptor(SecurityDescriptor, v9, 0);
                    if( Acl >= 0 )
                    {
                      Acl = RtlSetGroupSecurityDescriptor(SecurityDescriptor, v9, 0);
                      if( Acl >= 0 )
                      {
                        if( RtlValidSecurityDescriptor(SecurityDescriptor)
                          && (v11 = RtlLengthSecurityDescriptor(SecurityDescriptor),
                              LODWORD(BufferLength) = v11,
                              v11 >= 0x28) )
                        {
                          v12 = ExAllocatePoolWithTag(PagedPool, v11, 0x20207050ui64);
                          v2 = v12;
                          if( v12 )
                          {
                            memset((INT64)v12, 0i64);
                            Acl = RtlAbsoluteToSelfRelativeSD(SecurityDescriptor, v2, &BufferLength);
                            if( Acl >= 0 )
                            {
                              *a1 = (CHAR *)v2;
                              v2 = 0i64;
                            }
                          }
                          else
                          {
                            Acl = -1073741670;
                          }
                        }
                        else
                        {
                          Acl = -1073741595;
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
    ExFreePoolWithTag(v7, 0);
    if( v2 )
      ExFreePoolWithTag(v2, 0);
  }
  else
  {
    return(unsigned int)-1073741670;
  }
  return(unsigned int)Acl;
}

Referenced by: