PiAuGetServiceStateSecurityObject

NTSTATUS __stdcall PiAuGetServiceStateSecurityObject(CHAR **a1){
  VOID **v2; 
  NTSTATUS v3; 
  int v4; 
  int v5; 
  unsigned int v6; 
  VOID **PoolWithTag; 
  UINT64 v8; 
  _ACL *v9; 
  int Acl; 
  VOID *v11; 
  unsigned int v12; 
  size_t v13; 
  VOID **v14; 
  __int128 SecurityDescriptor[2]; 
  __int64 v17; 
  UINT64 BufferLength; 

  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v17 = 0i64;
  v2 = 0i64;
  v3 = RtlLengthSid((INT64)SeExports->SeUserModeDriversSid);
  v4 = RtlLengthSid((INT64)SeAliasAdminsSid) + v3;
  v5 = RtlLengthSid((INT64)SeLocalSystemSid) + v4;
  v6 = RtlLengthSid((INT64)SeTrustedInstallerSid) + 40 + v5;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v6, 538996816i64);
  v9 = (_ACL *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  Acl = RtlCreateAcl((PACL)PoolWithTag, (_ACL)v6, 2ui64, v8);
  if( Acl >= 0 )
  {
    v11 = SeTrustedInstallerSid;
    Acl = RtlpAddKnownAce(v9, 2ui64, 2ui64, 0x10000000ui64, SeTrustedInstallerSid, 0);
    if( Acl >= 0 )
    {
      Acl = RtlpAddKnownAce(v9, 2ui64, 2ui64, 0x80030006ui64, SeLocalSystemSid, 0);
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v9, 2ui64, 2ui64, 0x80000000ui64, SeAliasAdminsSid, 0);
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v9, 2ui64, 2ui64, 0x80000000ui64, SeExports->SeUserModeDriversSid, 0);
          if( Acl >= 0 )
          {
            Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
            if( Acl >= 0 )
            {
              Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v9, 0);
              if( Acl >= 0 )
              {
                Acl = RtlSetOwnerSecurityDescriptor(SecurityDescriptor, v11, 0);
                if( Acl >= 0 )
                {
                  Acl = RtlSetGroupSecurityDescriptor(SecurityDescriptor, v11, 0);
                  if( Acl >= 0 )
                  {
                    if( RtlValidSecurityDescriptor(SecurityDescriptor)
                      && (v12 = RtlLengthSecurityDescriptor((INT64)SecurityDescriptor),
                          LODWORD(BufferLength) = v12,
                          v12 >= 0x28) )
                    {
                      v13 = v12;
                      v14 = ExAllocatePoolWithTag(1ui64, v12, 538996816i64);
                      v2 = v14;
                      if( v14 )
                      {
                        memset(v14, 0i64, v13);
                        Acl = RtlAbsoluteToSelfRelativeSD(SecurityDescriptor, v2, &BufferLength);
                        if( Acl >= 0 )
                        {
                          *a1 = (CHAR *)v2;
                          v2 = 0i64;
                        }
                      }
                      else
                      {
                        Acl = -1073741670;
                      }
                    }
                    else
                    {
                      Acl = -1073741595;
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  ExFreePoolWithTag(v9, 0);
  if( v2 )
    ExFreePoolWithTag(v2, 0);
  return Acl;
}

Referenced by: