MiSessionObjectCreate

NTSTATUS __stdcall MiSessionObjectCreate(){
  NTSTATUS result; 
  NTSTATUS v1; 
  unsigned int v2; 
  _ACL *Pool; 
  UINT64 v4; 
  _ACL *v5; 
  int Acl; 
  _ACL *v7; 
  _MM_SESSION_SPACE *Session; 
  int v9; 
  PRKEVENT v10; 
  PRKEVENT v11; 
  NTSTATUS v12; 
  unsigned int SchedulingGroupSize; 
  _KSCHEDULING_GROUP *v14; 
  VOID *Sid; 
  VOID *Sida; 
  UINT64 NewType; 
  UINT64 PagedPoolCharge; 
  UINT64 NonPagedPoolCharge; 
  PRKEVENT Event; 
  VOID *DestinationString[3]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 SecurityDescriptor[2]; 
  __int64 v24; 
  WCHAR pszDest[128]; 

  memset(DestinationString, 0, sizeof(DestinationString));
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v24 = 0i64;
  Event = 0i64;
  result = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  if( result >= 0 )
  {
    v1 = RtlLengthSid((INT64)SeAliasAdminsSid);
    v2 = v1 + RtlLengthSid((INT64)SeLocalSystemSid) + 32;
    Pool = (_ACL *)MiAllocatePool(256i64, v2, 0x6C636144ui64);
    v5 = Pool;
    if( !Pool )
      return -1073741670;
    Acl = RtlCreateAcl(Pool, (_ACL)v2, 2ui64, v4);
    v7 = v5;
    if( Acl >= 0 )
    {
      Acl = RtlpAddKnownAce(v5, 2ui64, 0i64, 0xF0003ui64, SeAliasAdminsSid, 0);
      v7 = v5;
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v5, 2ui64, 0i64, 0xF0003ui64, SeLocalSystemSid, 0);
        if( Acl >= 0 )
        {
          Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v5, 0);
          if( Acl >= 0 )
          {
            Session = KeGetCurrentThread()->ApcState.Process->Session;
            v9 = RtlStringCchPrintfW(pszDest, 0x80ui64, (WCHAR *)L"\\KernelObjects\\Session%d");
            if( v9 < 0 )
            {
              ExFreePoolWithTag(v5, 0);
            }
            else
            {
              RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], pszDest);
              ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
              ObjectAttributes.Length = 48;
              ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
              ObjectAttributes.RootDirectory = 0i64;
              LODWORD(NonPagedPoolCharge) = 0;
              LODWORD(PagedPoolCharge) = 0;
              LODWORD(NewType) = 40;
              ObjectAttributes.Attributes = 512;
              ObjectAttributes.SecurityQualityOfService = 0i64;
              v9 = ObCreateObjectEx(
                     0i64,
                     MmSessionObjectType,
                     &ObjectAttributes,
                     0i64,
                     Sid,
                     NewType,
                     PagedPoolCharge,
                     NonPagedPoolCharge,
                     (VOID **)&Event,
                     0i64);
              ExFreePoolWithTag(v5, 0);
              if( v9 >= 0 )
              {
                v10 = Event;
                v11 = Event;
                *((_QWORD *)Event + 3) = Session;
                KeInitializeEvent((INT64)v11, 0, 0);
                *((_QWORD *)v10 + 4) = 0i64;
                if( !PsCpuFairShareEnabled || !*((_DWORD *)Session + 2) )
                  goto LABEL_10;
                SchedulingGroupSize = KeGetSchedulingGroupSize();
                v14 = (_KSCHEDULING_GROUP *)MiAllocatePool(72i64, SchedulingGroupSize, 0x70724753ui64);
                *((_QWORD *)v10 + 4) = v14;
                if( v14 )
                {
                  KeInsertSchedulingGroup(v14, (_KSCHEDULING_GROUP_POLICY)5i64, 0i64);
LABEL_10:
                  LODWORD(Sida) = 0;
                  result = ObInsertObjectEx(v10, 0i64, 1ui64, 0i64, (UINT64)Sida, 0i64, DestinationString);
                  v12 = result;
                  if( result >= 0 )
                  {
                    *((_DWORD *)Session + 1) |= 0x40u;
                    _InterlockedIncrement((volatile signed __int32 *)Session + 3);
                    *((VOID **)Session + 10) = DestinationString[0];
                    *((_QWORD *)Session + 9) = Event;
                    *((_DWORD *)Session + 254) = 2;
                    *((_DWORD *)Session + 255) = 1;
                    KeInitializeEvent((INT64)Session + 1024, 1, 1u);
                    return v12;
                  }
                  return result;
                }
                HalPutDmaAdapter((PADAPTER_OBJECT)v10);
                return -1073741670;
              }
            }
            return v9;
          }
        }
        v7 = v5;
      }
    }
    ExFreePoolWithTag(v7, 0);
    return Acl;
  }
  return result;
}

Referenced by: