IopCreateUmdfDirectory

NTSTATUS __stdcall IopCreateUmdfDirectory(){
  unsigned __int8 *SeLocalSystemSid; 
  unsigned int v1; 
  VOID **Pool_1; 
  VOID **v3; 
  int Acl; 
  unsigned int v5; 
  VOID **v6; 
  UINT64 v7; 
  _ACL *v8; 
  _UNICODE_STRING DestinationString; 
  __int128 SecurityDescriptor[2]; 
  __int64 v12; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  VOID *DirectoryHandle; 

  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  DirectoryHandle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v12 = 0i64;
  *(_DWORD *)IdentifierAuthority.Value = 0;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  DestinationString = 0i64;
  SeLocalSystemSid = (unsigned __int8 *)SeExports->SeLocalSystemSid;
  v1 = RtlLengthRequiredSid(6ui64);
  Pool_1 = IopVerifierExAllocatePool_1(1ui64, v1);
  v3 = Pool_1;
  if( !Pool_1 )
    return -1073741670;
  Acl = RtlInitializeSid(Pool_1, &IdentifierAuthority, 6u);
  if( Acl >= 0 )
  {
    *((_DWORD *)v3 + 2) = 80;
    *((_DWORD *)v3 + 3) = -1642288911;
    *((_DWORD *)v3 + 4) = 582572993;
    *((_DWORD *)v3 + 5) = 1835434367;
    *((_DWORD *)v3 + 6) = 1344795993;
    *((_DWORD *)v3 + 7) = 749280709;
    v5 = 4 * (SeLocalSystemSid[1] + *((unsigned __int8 *)v3 + 1)) + 40;
    v6 = IopVerifierExAllocatePool_1(1ui64, v5);
    v8 = (_ACL *)v6;
    if( v6 )
    {
      Acl = RtlCreateAcl((PACL)v6, (_ACL)v5, 2ui64, v7);
      if( Acl >= 0 )
      {
        Acl = RtlAddAccessAllowedAce(v8, 2ui64, 0x10000000, SeLocalSystemSid);
        if( Acl >= 0 )
        {
          Acl = RtlAddAccessAllowedAce(v8, 2ui64, 0x10000000, v3);
          if( Acl >= 0 )
          {
            Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
            if( Acl >= 0 )
            {
              Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v8, 0);
              if( Acl >= 0 )
              {
                RtlInitUnicodeString(&DestinationString, L"\\UMDFCommunicationPorts");
                ObjectAttributes.RootDirectory = 0i64;
                ObjectAttributes.SecurityQualityOfService = 0i64;
                ObjectAttributes.ObjectName = &DestinationString;
                ObjectAttributes.Length = 48;
                ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
                ObjectAttributes.Attributes = 528;
                Acl = NtCreateDirectoryObject(&DirectoryHandle, 983055, &ObjectAttributes);
                if( Acl >= 0 )
                  ObCloseHandle(DirectoryHandle, 0);
              }
            }
          }
        }
      }
      ExFreePoolWithTag(v8, 0);
    }
    else
    {
      Acl = -1073741670;
    }
  }
  ExFreePoolWithTag(v3, 0);
  return Acl;
}

Referenced by: