ObpCreateDefaultObjectTypeSD

VOID __fastcall ObpCreateDefaultObjectTypeSD(INT64 a1, UINT8 *a2){
  int v3; 
  int v4; 
  __int64 v5; 
  char *PoolWithTag; 
  char *v7; 
  int v8; 
  v3 = RtlLengthSid(SeWorldSid);
  v4 = RtlLengthSid(SeAliasAdminsSid) + v3;
  v5 = v4 + (unsigned int)RtlLengthSid(SeLocalSystemSid) + 44;
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v5 + 20, 0x6C636144ui64);
  v7 = PoolWithTag;
  if( PoolWithTag )
  {
    v8 = (_DWORD)PoolWithTag + 20;
    *(_OWORD *)PoolWithTag = 0i64;
    *((_DWORD *)PoolWithTag + 4) = 0;
    *PoolWithTag = 1;
    memset((INT64)(PoolWithTag + 20), 0i64);
    if( RtlCreateAcl((PACL)(v7 + 20), v5, 2u) < 0
      || (int)RtlpAddKnownAce((_ACL *)(v7 + 20), 2ui64, 0i64, 0xF0001ui64, SeWorldSid, 0) < 0
      || (int)RtlpAddKnownAce((_ACL *)(v7 + 20), 2ui64, 0i64, 0xF0001ui64, SeAliasAdminsSid, 0) < 0
      || (int)RtlpAddKnownAce((_ACL *)(v7 + 20), 2ui64, 0i64, 0xF0001ui64, SeLocalSystemSid, 0) < 0 )
    {
      ExFreePoolWithTag(v7, 0);
    }
    else
    {
      *((_WORD *)v7 + 1) |= 0x8004u;
      *((_DWORD *)v7 + 4) = v8 - (_DWORD)v7;
      *(_QWORD *)a1 = v7;
    }
  }
}

Referenced by: