PnpGetEnumSecurityDescriptor

void *__fastcall PnpGetEnumSecurityDescriptor(__int64 a1, __int64 a2, UINT64 a3){
  VOID *v3; 
  UINT64 v4; 
  UINT64 v5; 
  UINT64 v6; 
  int v7; 
  int v8; 
  UINT32 v9; 
  struct _ACL *PoolWithTag; 
  ACL *v11; 
  unsigned int v12; 
  VOID *v13; 
  VOID *v14; 
  struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  SID_IDENTIFIER_AUTHORITY v17; 
  SID_IDENTIFIER_AUTHORITY v18; 
  __int128 SecurityDescriptor[2]; 
  __int64 v20; 
  char Sid[12]; 
  char v22[12]; 
  char v23[12]; 
  char Owner[20]; 
  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_DWORD *)v17.Value = 0;
  LOBYTE(a3) = 1;
  *(_DWORD *)v18.Value = 0;
  v20 = 0i64;
  *(_WORD *)&v17.Value[4] = 768;
  v3 = 0i64;
  *(_WORD *)&v18.Value[4] = 256;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  if( (int)RtlInitializeSid(Sid, &IdentifierAuthority, a3) >= 0 )
  {
    *RtlSubAuthoritySid(Sid, 0i64) = 18;
    if( RtlValidSid(Sid) )
    {
      LOBYTE(v4) = 1;
      if( (int)RtlInitializeSid(v22, &v17, v4) >= 0 )
      {
        *RtlSubAuthoritySid(v22, 0i64) = 4;
        if( RtlValidSid(v22) )
        {
          LOBYTE(v5) = 1;
          if( (int)RtlInitializeSid(v23, &v18, v5) >= 0 )
          {
            *RtlSubAuthoritySid(v23, 0i64) = 0;
            if( RtlValidSid(v23) )
            {
              LOBYTE(v6) = 2;
              if( (int)RtlInitializeSid(Owner, &IdentifierAuthority, v6) >= 0 )
              {
                *RtlSubAuthoritySid(Owner, 0i64) = 32;
                *RtlSubAuthoritySid(Owner, 1ui64) = 544;
                if( RtlValidSid(Owner) )
                {
                  v7 = RtlLengthSid(v23);
                  v8 = RtlLengthSid(v22) + v7;
                  v9 = RtlLengthSid(Sid) + 32 + v8;
                  PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v9, 0x52504E50ui64);
                  v11 = PoolWithTag;
                  if( PoolWithTag )
                  {
                    if( RtlCreateAcl(PoolWithTag, v9, 2u) >= 0
                      && (int)RtlpAddKnownAce(v11, 2ui64, 2ui64, 0xF003Fui64, Sid, 0) >= 0
                      && (int)RtlpAddKnownAce(v11, 2ui64, 2ui64, 0x20000ui64, v22, 0) >= 0
                      && (int)RtlpAddKnownAce(v11, 2ui64, 2ui64, 0x20019ui64, v23, 0) >= 0
                      && RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64) >= 0
                      && RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v11, 0) >= 0
                      && RtlSetOwnerSecurityDescriptor(SecurityDescriptor, Owner, 1u) >= 0
                      && (int)RtlSetGroupSecurityDescriptor(SecurityDescriptor, Owner, 1u) >= 0 )
                    {
                      WORD1(SecurityDescriptor[0]) |= 0x1400u;
                      if( RtlValidSecurityDescriptor(SecurityDescriptor) )
                      {
                        v12 = RtlLengthSecurityDescriptor(SecurityDescriptor);
                        *(_DWORD *)IdentifierAuthority.Value = v12;
                        if( v12 >= 0x28 )
                        {
                          v13 = ExAllocatePoolWithTag(PagedPool, v12, 0x52504E50ui64);
                          v14 = v13;
                          if( v13 )
                          {
                            memset((INT64)v13, 0i64);
                            if( (int)RtlAbsoluteToSelfRelativeSD(
                                        SecurityDescriptor,
                                        v14,
                                        (UINT64 *)IdentifierAuthority.Value) >= 0 )
                            {
                              v3 = v14;
                              v14 = 0i64;
                            }
                            if( v14 )
                              ExFreePoolWithTag(v14, 0);
                          }
                        }
                      }
                    }
                    ExFreePoolWithTag(v11, 0);
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  return v3;
}

Referenced by: