PopCreateTimebrokerServiceSid

INT64 __stdcall PopCreateTimebrokerServiceSid(){
  unsigned int v0; 
  _DWORD *PoolWithTag; 
  _DWORD *v2; 
  UINT64 v3; 
  int v4; 
  struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  v0 = RtlLengthRequiredSid(6ui64);
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, v0, 0x67696450ui64);
  v2 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    LOBYTE(v3) = 6;
    v4 = RtlInitializeSid(v2, &IdentifierAuthority, v3);
    if( v4 >= 0 )
    {
      v2[2] = 80;
      v2[3] = 410965207;
      v2[4] = -1744070425;
      v2[5] = 1717734767;
      v2[6] = -1973635081;
      v2[7] = -539001157;
      PopTimeBrokerServiceSid = v2;
      v2 = 0i64;
    }
    if( v2 )
      ExFreePoolWithTag(v2, 0x67696450u);
  }
  else
  {
    return(unsigned int)-1073741801;
  }
  return(unsigned int)v4;
}

Referenced by: