ObpGetSilosRootDirectory

INT64 __fastcall ObpGetSilosRootDirectory(VOID **RootHandle){
  INT64 result; 
  int v3; 
  UINT32 v4; 
  struct _ACL *PoolWithTag; 
  ACL *v6; 
  int Acl; 
  __int128 SecurityDescriptor[2]; 
  __int64 v9; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  v9 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  LODWORD(result) = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  if( (int)result >= 0 )
  {
    v3 = RtlLengthSid(SeWorldSid);
    v4 = RtlLengthSid(SeLocalSystemSid) + 32 + v3;
    PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v4, 0x6C636144ui64);
    v6 = PoolWithTag;
    if( PoolWithTag )
    {
      Acl = RtlCreateAcl(PoolWithTag, v4, 2u);
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v6, 2ui64, 0i64, 0x20003ui64, SeWorldSid, 0);
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v6, 2ui64, 0i64, 0xF000Fui64, SeLocalSystemSid, 0);
          if( Acl >= 0 )
          {
            Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v6, 0);
            if( Acl >= 0 )
            {
              ObjectAttributes.Length = 48;
              ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpSilosDirectoryName;
              ObjectAttributes.RootDirectory = 0i64;
              ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
              ObjectAttributes.Attributes = 208;
              ObjectAttributes.SecurityQualityOfService = 0i64;
              Acl = ZwCreateDirectoryObject(RootHandle, 0xF000Fui64, &ObjectAttributes);
              if( Acl == 0x40000000 )
                Acl = 0;
            }
          }
        }
      }
      ExFreePoolWithTag(v6, 0x6C636144u);
      return(unsigned int)Acl;
    }
    else
    {
      return 3221225626i64;
    }
  }
  return result;
}

Referenced by: