CmpInitializeTrustedInstallerSid
INT64 __stdcall CmpInitializeTrustedInstallerSid(){
unsigned int v0;
INT64 result;
UINT64 v2;
_DWORD *v3;
struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
*(_DWORD *)IdentifierAuthority.Value = 0;
*(_WORD *)&IdentifierAuthority.Value[4] = 1280;
v0 = RtlLengthRequiredSid(6ui64);
result = (INT64)ExAllocatePoolWithTag(PagedPool, v0, 0x65536D43ui64);
CmpTrustedInstallerSid = (PSID)result;
v3 = (_DWORD *)result;
if( result )
{
LOBYTE(v2) = 6;
result = RtlInitializeSid((VOID *)result, &IdentifierAuthority, v2);
v3[2] = 80;
v3[3] = 956008885;
v3[4] = -876444647;
v3[5] = 1831038044;
v3[6] = 1853292631;
v3[7] = -2023488832;
}
return result;
}Referenced by:
CmInitSystem1