PnpGetPropertiesSecurityDescriptor
void *__fastcall PnpGetPropertiesSecurityDescriptor(__int64 a1, __int64 a2, UINT64 a3){
VOID *v3;
UINT32 v4;
struct _ACL *PoolWithTag;
ACL *v6;
unsigned int v7;
VOID *v8;
VOID *v9;
struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
__int128 SecurityDescriptor[2];
__int64 v13;
char Sid[16];
*(_WORD *)&IdentifierAuthority.Value[4] = 1280;
v3 = 0i64;
v13 = 0i64;
LOBYTE(a3) = 1;
*(_DWORD *)IdentifierAuthority.Value = 0;
memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
if( (int)RtlInitializeSid(Sid, &IdentifierAuthority, a3) >= 0 )
{
*RtlSubAuthoritySid(Sid, 0i64) = 18;
if( RtlValidSid(Sid) )
{
v4 = RtlLengthSid(Sid) + 16;
PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v4, 0x52504E50ui64);
v6 = PoolWithTag;
if( PoolWithTag )
{
if( RtlCreateAcl(PoolWithTag, v4, 2u) >= 0
&& (int)RtlpAddKnownAce(v6, 2ui64, 2ui64, 0xF003Fui64, Sid, 0) >= 0
&& RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64) >= 0
&& RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v6, 0) >= 0
&& RtlSetOwnerSecurityDescriptor(SecurityDescriptor, Sid, 1u) >= 0
&& (int)RtlSetGroupSecurityDescriptor(SecurityDescriptor, Sid, 1u) >= 0 )
{
WORD1(SecurityDescriptor[0]) |= 0x1400u;
if( RtlValidSecurityDescriptor(SecurityDescriptor) )
{
v7 = RtlLengthSecurityDescriptor(SecurityDescriptor);
*(_DWORD *)IdentifierAuthority.Value = v7;
if( v7 >= 0x28 )
{
v8 = ExAllocatePoolWithTag(PagedPool, v7, 0x52504E50ui64);
v9 = v8;
if( v8 )
{
memset((INT64)v8, 0i64);
if( (int)RtlAbsoluteToSelfRelativeSD(SecurityDescriptor, v9, (UINT64 *)IdentifierAuthority.Value) >= 0 )
{
v3 = v9;
v9 = 0i64;
}
if( v9 )
ExFreePoolWithTag(v9, 0);
}
}
}
}
ExFreePoolWithTag(v6, 0);
}
}
}
return v3;
}Referenced by:
PnpOpenPropertiesKey