MiCreateMemoryEventSD

INT64 __stdcall MiCreateMemoryEventSD(PSECURITY_DESCRIPTOR SecurityDescriptor){
  int Acl; 
  int v3; 
  int v4; 
  int v5; 
  int v6; 
  UINT32 v7; 
  struct _ACL *v8; 
  ACL *v9; 
  Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  if( Acl >= 0 )
  {
    v3 = RtlLengthSid(SeAllRestrictedAppPackagesSid);
    v4 = RtlLengthSid(SeAllAppPackagesSid) + v3;
    v5 = RtlLengthSid(SeWorldSid) + v4;
    v6 = RtlLengthSid(SeAliasAdminsSid) + v5;
    v7 = v6 + RtlLengthSid(SeLocalSystemSid) + 68;
    LODWORD(v8) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
    v9 = v8;
    if( v8 )
    {
      Acl = RtlCreateAcl(v8, v7, 2u);
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v9, 2ui64, 0i64, 0x120001ui64, SeWorldSid, 0);
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v9, 2ui64, 0i64, 0x1F0003ui64, SeAliasAdminsSid, 0);
          if( Acl >= 0 )
          {
            Acl = RtlpAddKnownAce(v9, 2ui64, 0i64, 0x1F0003ui64, SeLocalSystemSid, 0);
            if( Acl >= 0 )
            {
              Acl = RtlpAddKnownAce(v9, 2ui64, 0i64, 0x120001ui64, SeAllAppPackagesSid, 0);
              if( Acl >= 0 )
              {
                Acl = RtlpAddKnownAce(v9, 2ui64, 0i64, 0x120001ui64, SeAllRestrictedAppPackagesSid, 0);
                if( Acl >= 0 )
                {
                  Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v9, 0);
                  if( Acl >= 0 )
                  {
                    v9 = 0i64;
                    Acl = 0;
                  }
                }
              }
            }
          }
        }
      }
      if( v9 )
        ExFreePoolWithTag(v9, 0);
    }
  }
  return(unsigned int)Acl;
}

Referenced by: