PiAuCreateUserSids
VOID __stdcall PiAuCreateUserSids(_KPRCB *Prcb, UINT8 DynamicProcessor){
_ETHREAD **p_CurrentThread;
_ETHREAD **p_NextThread;
_ETHREAD **p_IdleThread;
unsigned __int8 *p_NestingLevel;
unsigned __int64 *p_RspBase;
unsigned __int64 *p_PrcbLock;
_SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
_SID_IDENTIFIER_AUTHORITY v10;
_SID_IDENTIFIER_AUTHORITY v11;
*(_WORD *)&IdentifierAuthority.Value[4] = 1280;
*(_DWORD *)IdentifierAuthority.Value = 0;
*(_DWORD *)v10.Value = 0;
*(_WORD *)&v10.Value[4] = 256;
*(_DWORD *)v11.Value = 0;
*(_WORD *)&v11.Value[4] = 3840;
memset(Prcb, 0i64, 0x40u);
if( PiAuAllocateAndInitializeSid((VOID **)Prcb, &IdentifierAuthority, 1ui64) >= 0 )
{
*(_DWORD *)(*(_QWORD *)&Prcb->_MxCsr + 8i64) = 18;
if( RtlValidSid(*(_BYTE **)&Prcb->_MxCsr) )
{
p_CurrentThread = &Prcb->CurrentThread;
if( PiAuAllocateAndInitializeSid((VOID **)&Prcb->CurrentThread, &v10, 1ui64) >= 0 )
{
*(_DWORD *)&(*p_CurrentThread)->Tcb.gap0[8] = 0;
if( RtlValidSid(*p_CurrentThread) )
{
p_NextThread = &Prcb->NextThread;
if( PiAuAllocateAndInitializeSid((VOID **)&Prcb->NextThread, &IdentifierAuthority, 2ui64) >= 0 )
{
*(_DWORD *)&(*p_NextThread)->Tcb.gap0[8] = 32;
*(_DWORD *)&(*p_NextThread)->Tcb.gap0[12] = 544;
if( RtlValidSid(*p_NextThread) )
{
p_IdleThread = &Prcb->IdleThread;
if( PiAuAllocateAndInitializeSid((VOID **)&Prcb->IdleThread, &IdentifierAuthority, 1ui64) >= 0 )
{
*(_DWORD *)&(*p_IdleThread)->Tcb.gap0[8] = 2;
if( RtlValidSid(*p_IdleThread) )
{
p_NestingLevel = &Prcb->NestingLevel;
if( PiAuAllocateAndInitializeSid((VOID **)&Prcb->NestingLevel, &IdentifierAuthority, 2ui64) >= 0 )
{
*(_DWORD *)(*(_QWORD *)p_NestingLevel + 8i64) = 32;
*(_DWORD *)(*(_QWORD *)p_NestingLevel + 12i64) = 545;
if( RtlValidSid(*(_BYTE **)p_NestingLevel) )
{
p_RspBase = &Prcb->RspBase;
if( PiAuAllocateAndInitializeSid((VOID **)&Prcb->RspBase, &IdentifierAuthority, 1ui64) >= 0 )
{
*(_DWORD *)(*p_RspBase + 8) = 19;
if( RtlValidSid((_BYTE *)*p_RspBase) )
{
p_PrcbLock = &Prcb->PrcbLock;
if( PiAuAllocateAndInitializeSid((VOID **)&Prcb->PrcbLock, &IdentifierAuthority, 1ui64) >= 0 )
{
*(_DWORD *)(*p_PrcbLock + 8) = 20;
if( RtlValidSid((_BYTE *)*p_PrcbLock) )
{
if( PiAuAllocateAndInitializeSid((VOID **)&Prcb->PriorityState, &v11, 2ui64) >= 0 )
{
*((_DWORD *)Prcb->PriorityState + 2) = 2;
*((_DWORD *)Prcb->PriorityState + 3) = 1;
RtlValidSid(Prcb->PriorityState);
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}Referenced by:
PiAuCreateSecurityObjects