SepInitializationPhase1

UINT8 __fastcall SepInitializationPhase1(){
  bool IsCurrentThreadInServerSilo; 
  INT8 v1; 
  struct _ACL *PoolWithTag; 
  ACL *v3; 
  INT8 v4; 
  UINT8 v5; 
  INT64 v6; 
  INT64 v7; 
  void *DirectoryHandle; 
  struct _UNICODE_STRING UnicodeString; 
  void *EventHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _STRING DestinationString; 
  char SecurityDescriptor[40]; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DirectoryHandle = 0i64;
  EventHandle = 0i64;
  DestinationString = 0i64;
  UnicodeString = 0i64;
  IsCurrentThreadInServerSilo = PsIsCurrentThreadInServerSilo();
  if( !IsCurrentThreadInServerSilo )
  {
    ObInsertObject(
      (PVOID)(*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1208i64) & 0xFFFFFFFFFFFFFFF0ui64),
      0i64,
      0i64,
      0i64,
      0i64,
      0i64);
    SeAnonymousLogonToken = (_TOKEN *)SeMakeAnonymousLogonToken();
    SeAnonymousLogonTokenNoEveryone = (PVOID)SeMakeAnonymousLogonTokenNoEveryone();
  }
  RtlInitAnsiString(&DestinationString, "\\Security", v1);
  RtlAnsiStringToUnicodeString(&UnicodeString, &DestinationString, 1u);
  RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x100ui64, 0x20206553ui64);
  v3 = PoolWithTag;
  if( !PoolWithTag )
    return 0;
  RtlCreateAcl(PoolWithTag, 0x100u, 2u);
  RtlAddAccessAllowedAce(v3, 2u, 0xF000Fu, SeLocalSystemSid);
  RtlAddAccessAllowedAce(v3, 2u, 0x20003u, SeAliasAdminsSid);
  RtlAddAccessAllowedAce(v3, 2u, 2u, SeWorldSid);
  RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v3, 0);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  ObjectAttributes.ObjectName = &UnicodeString;
  ObjectAttributes.Attributes = 80;
  ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
  ObjectAttributes.Length = 48;
  ZwCreateDirectoryObject(&DirectoryHandle, 0xF000Fui64, &ObjectAttributes);
  RtlFreeAnsiString(&UnicodeString);
  ExFreePoolWithTag(v3, 0);
  RtlInitAnsiString(&DestinationString, "LSA_AUTHENTICATION_INITIALIZED", v4);
  RtlAnsiStringToUnicodeString(&UnicodeString, &DestinationString, 1u);
  ObjectAttributes.SecurityQualityOfService = 0i64;
  ObjectAttributes.RootDirectory = DirectoryHandle;
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &UnicodeString;
  ObjectAttributes.SecurityDescriptor = (void *)SePublicDefaultSd;
  ObjectAttributes.Attributes = 80;
  ZwCreateEvent(&EventHandle, 0x40000000ui64, &ObjectAttributes, NotificationEvent, 0);
  RtlFreeAnsiString(&UnicodeString);
  ZwClose(DirectoryHandle);
  ZwClose(EventHandle);
  if( !IsCurrentThreadInServerSilo )
  {
    SepInitProcessAuditSd();
    SepInitializeCodeIntegrity();
    SepInitializeAuthorizationCallbacks(v7, v6);
    if( (int)SepInitializeSingletonAttributesStructures() < 0 )
      return 0;
  }
  SddlBaseInitialize(v5);
  return 1;
}

Referenced by: