PspInitializeSystemPartitionPhase0
INT64 __stdcall PspInitializeSystemPartitionPhase0(){
int Acl;
UINT32 v1;
struct _ACL *PoolWithTag;
ACL *v3;
__int64 v5[2];
__int128 SecurityDescriptor[2];
__int64 v7;
INT64 a1;
__int64 v9;
__int64 *v10;
int v11;
int v12;
__int128 *v13;
__int64 v14;
HIDWORD(a1) = 0;
v12 = 0;
v7 = 0i64;
v5[0] = 4194366i64;
v5[1] = (__int64)L"\\KernelObjects\\MemoryPartition0";
memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
if( Acl >= 0 )
{
v1 = 4 * *((unsigned __int8 *)SeAliasAdminsSid + 1) + 28;
PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v1, 0x6C636144ui64);
v3 = PoolWithTag;
if( PoolWithTag )
{
Acl = RtlCreateAcl(PoolWithTag, v1, 2u);
if( Acl >= 0 )
{
Acl = RtlAddAccessAllowedAce(v3, 2u, 0x1F0003u, SeAliasAdminsSid);
if( Acl >= 0 )
{
Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v3, 0);
if( Acl >= 0 )
{
v9 = 0i64;
v14 = 0i64;
v10 = v5;
LODWORD(a1) = 48;
v13 = SecurityDescriptor;
v11 = 512;
Acl = PspAllocatePartition((INT64)&a1, 2031619i64, 0, 0i64, 1, &PspSystemPartition, 0i64);
}
}
}
ExFreePoolWithTag(v3, 0);
}
else
{
return(unsigned int)-1073741670;
}
}
return(unsigned int)Acl;
}Referenced by:
PspInitPhase0