PiAuCreateLocalSystemSecurityObject

NTSTATUS __stdcall PiAuCreateLocalSystemSecurityObject(_PI_AU_USER_SIDS *UserSids){
  unsigned __int8 *v2; 
  VOID **v3; 
  unsigned int v4; 
  VOID **PoolWithTag; 
  UINT64 v6; 
  _ACL *v7; 
  int Acl; 
  unsigned int v9; 
  size_t v10; 
  VOID **v11; 
  __int128 SecurityDescriptor[2]; 
  __int64 v14; 
  UINT64 BufferLength; 

  v14 = 0i64;
  v2 = *(unsigned __int8 **)UserSids;
  v3 = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v4 = 4 * v2[1] + 24;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v4, 1198550608i64);
  v7 = (_ACL *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  Acl = RtlCreateAcl((PACL)PoolWithTag, (_ACL)v4, 2ui64, v6);
  if( Acl >= 0 )
  {
    Acl = RtlAddAccessAllowedAceEx(v7, 2ui64, 0i64, 983040, *(VOID **)UserSids);
    if( Acl >= 0 )
    {
      Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
      if( Acl >= 0 )
      {
        Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v7, 0);
        if( Acl >= 0 )
        {
          Acl = RtlSetOwnerSecurityDescriptor(SecurityDescriptor, *(VOID **)UserSids, 0);
          if( Acl >= 0 )
          {
            Acl = RtlSetGroupSecurityDescriptor(SecurityDescriptor, *(VOID **)UserSids, 0);
            if( Acl >= 0 )
            {
              if( RtlValidSecurityDescriptor(SecurityDescriptor)
                && (v9 = RtlLengthSecurityDescriptor((INT64)SecurityDescriptor), LODWORD(BufferLength) = v9, v9 >= 0x28) )
              {
                v10 = v9;
                v11 = ExAllocatePoolWithTag(1ui64, v9, 1198550608i64);
                v3 = v11;
                if( v11 )
                {
                  memset(v11, 0i64, v10);
                  Acl = RtlAbsoluteToSelfRelativeSD(SecurityDescriptor, v3, &BufferLength);
                  if( Acl >= 0 )
                  {
                    SecurityObject = v3;
                    v3 = 0i64;
                  }
                }
                else
                {
                  Acl = -1073741670;
                }
              }
              else
              {
                Acl = -1073741595;
              }
            }
          }
        }
      }
    }
  }
  ExFreePoolWithTag(v7, 0x47706E50u);
  if( v3 )
    ExFreePoolWithTag(v3, 0x47706E50u);
  return Acl;
}

Referenced by: