ObpGetDosDevicesProtection

NTSTATUS __stdcall ObpGetDosDevicesProtection(VOID *SecurityDescriptor){
  NTSTATUS v2; 
  int v3; 
  int v4; 
  unsigned int v5; 
  VOID **PoolWithTag; 
  UINT64 v7; 
  _ACL *v8; 
  VOID *Sid; 
  VOID *v10; 
  NTSTATUS v12; 
  unsigned int v13; 
  VOID **v14; 
  UINT64 v15; 
  VOID *v16; 
  PVOID Ace; 

  Ace = 0i64;
  RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  if( (dword_140C25E70 & 1) != 0 )
  {
    v2 = RtlLengthSid((INT64)SeLocalSystemSid);
    v3 = RtlLengthSid((INT64)SeWorldSid) + v2;
    v4 = RtlLengthSid((INT64)SeCreatorOwnerSid) + 80 + 2 * v3;
    v5 = RtlLengthSid((INT64)SeAliasAdminsSid) + v4;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v5, 1818452292i64);
    v8 = (_ACL *)PoolWithTag;
    if( PoolWithTag )
    {
      RtlCreateAcl((PACL)PoolWithTag, (_ACL)v5, 2ui64, v7);
      Sid = SeWorldSid;
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0xA0000000ui64, SeWorldSid, 0);
      v10 = SeLocalSystemSid;
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0x10000000ui64, SeLocalSystemSid, 0);
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0x20000000ui64, Sid, 0);
      RtlGetAce(v8, 2ui64, &Ace);
      *((_BYTE *)Ace + 1) |= 0xBu;
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0x10000000ui64, SeAliasAdminsSid, 0);
      RtlGetAce(v8, 3ui64, &Ace);
      *((_BYTE *)Ace + 1) |= 0xBu;
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0x10000000ui64, v10, 0);
      RtlGetAce(v8, 4ui64, &Ace);
      *((_BYTE *)Ace + 1) |= 0xBu;
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0x10000000ui64, SeCreatorOwnerSid, 0);
      RtlGetAce(v8, 5ui64, &Ace);
LABEL_4:
      *((_BYTE *)Ace + 1) |= 0xBu;
      RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v8, 0);
      return 0;
    }
  }
  else
  {
    v12 = RtlLengthSid((INT64)SeWorldSid);
    v13 = RtlLengthSid((INT64)SeLocalSystemSid) + 44 + 2 * v12;
    v14 = ExAllocatePoolWithTag(1ui64, v13, 1818452292i64);
    v8 = (_ACL *)v14;
    if( v14 )
    {
      RtlCreateAcl((PACL)v14, (_ACL)v13, 2ui64, v15);
      v16 = SeWorldSid;
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0xE0000000ui64, SeWorldSid, 0);
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0x10000000ui64, SeLocalSystemSid, 0);
      RtlpAddKnownAce(v8, 2ui64, 0i64, 0x10000000ui64, v16, 0);
      RtlGetAce(v8, 2ui64, &Ace);
      goto LABEL_4;
    }
  }
  return -1073741801;
}

Referenced by: