PiDevCfgGetKeySecurityDescriptor

NTSTATUS __stdcall PiDevCfgGetKeySecurityDescriptor(PVOID KeyHandle, PVOID *KeySecurityDescriptor){
  ACL *v4; 
  VOID *v5; 
  NTSTATUS SecurityObject; 
  NTSTATUS GroupSecurityDescriptor; 
  ULONG v9; 
  char *PoolWithTag; 
  unsigned int v11; 
  PACL v12; 
  UINT32 v13; 
  struct _ACL *v14; 
  unsigned int v15; 
  VOID *v16; 
  PULONG LengthNeeded; 
  unsigned __int8 DaclPresent; 
  unsigned __int8 GroupDefaulted[3]; 
  ULONG v20; 
  PSID Group; 
  PACL Dacl; 
  PVOID Ace; 
  PVOID AceList; 
  __int128 AbsoluteSecurityDescriptor[2]; 
  __int64 v26; 
  char SecurityDescriptor[56]; 
  *KeySecurityDescriptor = 0i64;
  v26 = 0i64;
  v20 = 0;
  Group = 0i64;
  DaclPresent = 0;
  Dacl = 0i64;
  Ace = 0i64;
  v4 = 0i64;
  AceList = 0i64;
  memset(AbsoluteSecurityDescriptor, 0, sizeof(AbsoluteSecurityDescriptor));
  v5 = 0i64;
  SecurityObject = ZwQuerySecurityObject(KeyHandle, 2ui64, SecurityDescriptor, 0x34ui64, (UINT64 *)&v20);
  GroupSecurityDescriptor = SecurityObject;
  if( SecurityObject == -1073741789 )
    return -1073741720;
  if( SecurityObject >= 0 )
  {
    GroupSecurityDescriptor = RtlGetGroupSecurityDescriptor(SecurityDescriptor, &Group, GroupDefaulted);
    if( GroupSecurityDescriptor >= 0 )
    {
      if( !Group )
        return -1073741722;
      if( !RtlEqualSid(Group, PiDevCfgNullSid) )
        return -1073741720;
      v9 = 240;
      PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, 0xF0ui64, 0x63647050ui64);
      if( PoolWithTag )
      {
        while( 1 )
        {
          GroupSecurityDescriptor = ZwQuerySecurityObject(KeyHandle, 4ui64, PoolWithTag, v9, (UINT64 *)&v20);
          if( GroupSecurityDescriptor != -1073741789 )
            break;
          if( v20 <= v9 )
          {
            GroupSecurityDescriptor = -1073741595;
            break;
          }
          v9 = v20;
          ExFreePoolWithTag(PoolWithTag, 0);
          PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v9, 0x63647050ui64);
          if( !PoolWithTag )
            goto LABEL_13;
        }
        v11 = 0;
        if( GroupSecurityDescriptor < 0 )
          goto LABEL_14;
        GroupSecurityDescriptor = RtlGetDaclSecurityDescriptor(PoolWithTag, &DaclPresent, &Dacl, GroupDefaulted);
        if( GroupSecurityDescriptor < 0 )
          goto LABEL_14;
        if( !DaclPresent || (v12 = Dacl) == 0i64 )
        {
          GroupSecurityDescriptor = -1073741275;
          goto LABEL_14;
        }
        if( Dacl->AceCount )
        {
          do
          {
            GroupSecurityDescriptor = RtlGetAce(v12, v11, &Ace);
            if( GroupSecurityDescriptor < 0 )
              goto LABEL_14;
            if( !*(_BYTE *)Ace
              && (*((_DWORD *)Ace + 1) & 0xF003F) == 983103
              && RtlEqualSid((char *)Ace + 8, SeLocalSystemSid) )
            {
              *KeySecurityDescriptor = PoolWithTag;
              return GroupSecurityDescriptor;
            }
          }
          while( ++v11 < v12->AceCount );
        }
        v13 = RtlLengthSid(SeLocalSystemSid) + v12->AclSize + 8;
        v14 = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v13, 0x63647050ui64);
        v4 = v14;
        if( v14 )
        {
          GroupSecurityDescriptor = RtlCreateAcl(v14, v13, 2u);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          GroupSecurityDescriptor = RtlGetAce(v12, 0i64, &AceList);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          LODWORD(LengthNeeded) = v12->AclSize - 8;
          GroupSecurityDescriptor = RtlAddAce(v4, 2ui64, 0i64, AceList, (UINT64)LengthNeeded);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          GroupSecurityDescriptor = RtlpAddKnownAce(v4, 2ui64, 2ui64, 0xF003Fui64, SeLocalSystemSid, 0);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          GroupSecurityDescriptor = RtlCreateSecurityDescriptor(AbsoluteSecurityDescriptor, 1ui64);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          GroupSecurityDescriptor = RtlSetDaclSecurityDescriptor(AbsoluteSecurityDescriptor, 1u, v4, 0);
          if( GroupSecurityDescriptor < 0 )
            goto LABEL_14;
          if( RtlValidSecurityDescriptor(AbsoluteSecurityDescriptor) )
          {
            v15 = RtlLengthSecurityDescriptor(AbsoluteSecurityDescriptor);
            LODWORD(Group) = v15;
            if( v15 >= 0x28 )
            {
              v16 = ExAllocatePoolWithTag(PagedPool, v15, 0x63647050ui64);
              v5 = v16;
              if( v16 )
              {
                memset((INT64)v16, 0i64);
                GroupSecurityDescriptor = RtlAbsoluteToSelfRelativeSD(AbsoluteSecurityDescriptor, v5, (UINT64 *)&Group);
                if( GroupSecurityDescriptor >= 0 )
                {
                  *KeySecurityDescriptor = v5;
                  v5 = 0i64;
                }
                goto LABEL_14;
              }
              goto LABEL_13;
            }
          }
          GroupSecurityDescriptor = -1073741595;
LABEL_14:
          if( PoolWithTag && PoolWithTag != SecurityDescriptor )
            ExFreePoolWithTag(PoolWithTag, 0);
          if( v5 )
            ExFreePoolWithTag(v5, 0);
          if( v4 )
            ExFreePoolWithTag(v4, 0);
          return GroupSecurityDescriptor;
        }
      }
LABEL_13:
      GroupSecurityDescriptor = -1073741670;
      goto LABEL_14;
    }
  }
  return GroupSecurityDescriptor;
}

Referenced by: