WmipInitializeSecurity

INT64 __fastcall WmipInitializeSecurity(){
  UINT32 v0; 
  struct _ACL *PoolWithTag; 
  ACL *v2; 
  int Acl; 
  PSID v4; 
  WCHAR v5; 
  INT64 v6; 
  struct _UNICODE_STRING DestinationString; 
  __int16 result; 
  char result_2; 
  int v10; 
  _GENERIC_MAPPING v11; 
  int v12; 
  int v13; 
  int v14; 
  __int64(__fastcall *v15)(); 
  INT64(__fastcall *v16)(VOID *, _SECURITY_OPERATION_CODE, UINT64 *, VOID *, UINT64 *, VOID **, _POOL_TYPE, _GENERIC_MAPPING *, CHAR); 
  DestinationString = 0i64;
  v0 = 4
     * (*((unsigned __int8 *)SeLocalSystemSid + 1)
      + *((unsigned __int8 *)SeAliasAdminsSid + 1)
      + *((unsigned __int8 *)SeAliasUsersSid + 1)
      + *((unsigned __int8 *)SeExports->SeLocalServiceSid + 1)
      + *((unsigned __int8 *)SeExports->SeNetworkServiceSid + 1))
     + 116;
  PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v0, 0x70696D57ui64);
  v2 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  Acl = RtlCreateAcl(PoolWithTag, v0, 2u);
  if( Acl < 0 )
    goto LABEL_14;
  Acl = RtlAddAccessAllowedAce(v2, 2u, 0x1FFFFFu, SeLocalSystemSid);
  if( Acl < 0 )
    goto LABEL_14;
  Acl = RtlAddAccessAllowedAce(v2, 2u, 0x800u, SeAliasUsersSid);
  if( Acl < 0 )
    goto LABEL_14;
  v4 = SeAliasAdminsSid;
  Acl = RtlAddAccessAllowedAce(v2, 2u, 0x11FFFFFu, SeAliasAdminsSid);
  if( Acl < 0 )
    goto LABEL_14;
  Acl = RtlAddAccessAllowedAce(v2, 2u, 0x1FFFFFu, SeExports->SeLocalServiceSid);
  if( Acl < 0 )
    goto LABEL_14;
  Acl = RtlAddAccessAllowedAce(v2, 2u, 0x1FFFFFu, SeExports->SeNetworkServiceSid);
  if( Acl < 0 )
    goto LABEL_14;
  WmipDefaultAccessSd = (__int64)WmipDefaultAccessSecurityDescriptor;
  RtlCreateSecurityDescriptor(WmipDefaultAccessSecurityDescriptor, 1ui64);
  Acl = RtlSetDaclSecurityDescriptor(WmipDefaultAccessSecurityDescriptor, 1u, v2, 0);
  if( Acl < 0 )
    goto LABEL_14;
  Acl = RtlSetOwnerSecurityDescriptor(WmipDefaultAccessSecurityDescriptor, v4, 0);
  if( Acl < 0 )
    goto LABEL_14;
  Acl = RtlSetGroupSecurityDescriptor(WmipDefaultAccessSecurityDescriptor, v4, 0);
  if( Acl < 0 )
    goto LABEL_14;
  SeCaptureSubjectContext(&WmipSystemSubjectContext);
  memset((INT64)&result, 0i64);
  result = 120;
  v10 = 256;
  result_2 = result_2 & 0xE7 | 8;
  v12 = 2039807;
  v16 = WmipSecurityMethod;
  v15 = WmipDeleteMethod;
  v11 = WmipGenericMapping;
  v13 = 512;
  v14 = 168;
  RtlInitUnicodeString(&DestinationString, L"WmiGuid", v5);
  v6 = ObCreateObjectType(&DestinationString, (__int64)&result, 0i64, (__int64)&WmipGuidObjectType);
  Acl = v6;
  if( (int)v6 < 0 )
  {
LABEL_14:
    ExFreePoolWithTag(v2, 0);
    WmipDefaultAccessSd = 0i64;
    return(unsigned int)Acl;
  }
  return v6;
}

Referenced by: