SepInitializationPhase1

UINT8 __stdcall SepInitializationPhase1(){
  BOOL IsCurrentThreadInServerSilo; 
  VOID **PoolWithTag; 
  UINT64 v2; 
  _ACL *v3; 
  VOID *DirectoryHandle; 
  _UNICODE_STRING UnicodeString; 
  void *EventHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _STRING DestinationString; 
  char SecurityDescriptor[40]; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DirectoryHandle = 0i64;
  EventHandle = 0i64;
  DestinationString = 0i64;
  UnicodeString = 0i64;
  IsCurrentThreadInServerSilo = PsIsCurrentThreadInServerSilo();
  if( !IsCurrentThreadInServerSilo )
  {
    ObInsertObject(
      (VOID *)(KeGetCurrentThread()->ApcState.Process->Token.Value & 0xFFFFFFFFFFFFFFF0ui64),
      0i64,
      0,
      0i64,
      0i64,
      0i64);
    SeAnonymousLogonToken = (_TOKEN *)SeMakeAnonymousLogonToken();
    SeAnonymousLogonTokenNoEveryone = SeMakeAnonymousLogonTokenNoEveryone();
  }
  RtlInitAnsiString(&DestinationString, "\\Security");
  RtlAnsiStringToUnicodeString(&UnicodeString, &DestinationString, 1u);
  RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x100ui64, 538994003i64);
  v3 = (_ACL *)PoolWithTag;
  if( !PoolWithTag )
    return 0;
  RtlCreateAcl((PACL)PoolWithTag, (_ACL)256i64, 2ui64, v2);
  RtlAddAccessAllowedAce(v3, 2ui64, 983055, SeLocalSystemSid);
  RtlAddAccessAllowedAce(v3, 2ui64, 131075, SeAliasAdminsSid);
  RtlAddAccessAllowedAce(v3, 2ui64, 2, SeWorldSid);
  RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v3, 0);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  ObjectAttributes.ObjectName = &UnicodeString;
  ObjectAttributes.Attributes = 80;
  ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
  ObjectAttributes.Length = 48;
  ZwCreateDirectoryObject(&DirectoryHandle, 983055, &ObjectAttributes);
  RtlFreeAnsiString(&UnicodeString);
  ExFreePoolWithTag(v3, 0);
  RtlInitAnsiString(&DestinationString, "LSA_AUTHENTICATION_INITIALIZED");
  RtlAnsiStringToUnicodeString(&UnicodeString, &DestinationString, 1u);
  ObjectAttributes.SecurityQualityOfService = 0i64;
  ObjectAttributes.RootDirectory = DirectoryHandle;
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &UnicodeString;
  ObjectAttributes.SecurityDescriptor = (void *)SePublicDefaultSd;
  ObjectAttributes.Attributes = 80;
  ZwCreateEvent((UINT64)&EventHandle, 0x40000000ui64, (INT64)&ObjectAttributes, 0i64, 0);
  RtlFreeAnsiString(&UnicodeString);
  ZwClose((_HANDLE)DirectoryHandle);
  ZwClose((_HANDLE)EventHandle);
  if( !IsCurrentThreadInServerSilo )
  {
    SepInitProcessAuditSd();
    SepInitializeCodeIntegrity();
    SepInitializeAuthorizationCallbacks();
    if( SepInitializeSingletonAttributesStructures() < 0 )
      return 0;
  }
  SddlBaseInitialize();
  return 1;
}

Referenced by: