PopCreateHiberFileSecurityDescriptor

ACL *__fastcall PopCreateHiberFileSecurityDescriptor(){
  ACL *v0; 
  _ACL *v1; 
  unsigned __int8 *PoolWithTag; 
  UINT64 v3; 
  unsigned __int8 *v4; 
  __int64 v5; 
  struct _ACL *v6; 
  ACL *v7; 
  NTSTATUS SecurityDescriptor; 
  ACL *v9; 
  PVOID Ace; 
  v0 = 0i64;
  WORD2(Ace) = 256;
  LODWORD(Ace) = 0;
  v1 = 0i64;
  PoolWithTag = (unsigned __int8 *)ExAllocatePoolWithTag(PagedPool, 0xCui64, 0x72626968ui64);
  v4 = PoolWithTag;
  if( !PoolWithTag )
    return v0;
  LOBYTE(v3) = 1;
  if( (int)RtlInitializeSid(PoolWithTag, (SID_IDENTIFIER_AUTHORITY *)&Ace, v3) >= 0 )
  {
    *RtlSubAuthoritySid(v4, 0i64) = 0;
    v5 = 4 * (unsigned int)v4[1] + 24;
    if( (unsigned int)v5 >= 4 * (unsigned int)v4[1] + 16 )
    {
      v6 = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, (unsigned int)v5, 0x72626968ui64);
      v1 = v6;
      if( v6 )
      {
        if( RtlCreateAcl(v6, v5, 2u) >= 0 && (int)RtlpAddKnownAce(v1, 2ui64, 0i64, 0x10000ui64, v4, 0) >= 0 )
        {
          Ace = 0i64;
          RtlGetAce(v1, 0i64, &Ace);
          *((_BYTE *)Ace + 1) |= 2u;
          v7 = (ACL *)ExAllocatePoolWithTag(PagedPool, v5 + 40, 0x72626968ui64);
          v0 = v7;
          if( v7 )
          {
            memmove((UINT8 *)&v7[5], (UINT8 *)v1, (unsigned int)v5);
            SecurityDescriptor = RtlCreateSecurityDescriptor(v0, 1ui64);
            v9 = v0;
            if( SecurityDescriptor >= 0 )
            {
              if( RtlSetDaclSecurityDescriptor(v0, 1u, v0 + 5, 0) >= 0 )
                goto LABEL_10;
              v9 = v0;
            }
            ExFreePoolWithTag(v9, 0);
          }
        }
      }
    }
  }
LABEL_10:
  ExFreePoolWithTag(v4, 0);
  if( v1 )
    ExFreePoolWithTag(v1, 0);
  return v0;
}

Referenced by: