ViInitializeLocalSystemDescriptor
VOID *__stdcall ViInitializeLocalSystemDescriptor(){
VOID **PoolWithTag;
VOID **v1;
unsigned int v2;
VOID **v3;
UINT64 v4;
_ACL *v5;
NTSTATUS Acl;
if( !ViLocalSystemDescriptor )
{
if( SeLocalSystemSid )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1432777302i64);
v1 = PoolWithTag;
if( PoolWithTag )
{
if( RtlCreateSecurityDescriptor(PoolWithTag, 1ui64) < 0 )
goto LABEL_13;
v2 = RtlLengthSid((INT64)SeLocalSystemSid) + 20;
v3 = ExAllocatePoolWithTag(1ui64, v2, 1432777302i64);
v5 = (_ACL *)v3;
if( !v3 )
goto LABEL_13;
Acl = RtlCreateAcl((PACL)v3, (_ACL)v2, 2ui64, v4);
if( Acl < 0 )
goto LABEL_17;
Acl = RtlAddAccessAllowedAce(v5, 2ui64, 1, SeLocalSystemSid);
if( Acl < 0 )
goto LABEL_17;
Acl = RtlSetDaclSecurityDescriptor(v1, 1u, v5, 0);
if( Acl < 0 )
goto LABEL_17;
if( _InterlockedCompareExchange64(
(volatile signed __int64 *)&ViLocalSystemDescriptor,
(signed __int64)v1,
0i64) )
{
Acl = -1073741595;
}
if( Acl < 0 )
{
LABEL_17:
ExFreePoolWithTag(v5, 0x55667256u);
if( Acl < 0 )
LABEL_13:
ExFreePoolWithTag(v1, 0x55667256u);
}
}
}
}
return ViLocalSystemDescriptor;
}Referenced by:
VfUtilIsLocalSystem