RtlpSysVolCreateSecurityDescriptor
NTSTATUS __stdcall RtlpSysVolCreateSecurityDescriptor(PVOID *SecurityDescriptor, ACL **Acl){
void *PoolWithTag;
void *v5;
int v6;
UINT32 v7;
struct _ACL *v8;
ACL *v9;
int v10;
ACL *v11;
UINT64 v12;
NTSTATUS result;
void *Src;
__int16 Sid;
int v16;
__int16 v17;
int v18;
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x536C6F56ui64);
v5 = PoolWithTag;
if( !PoolWithTag )
return -1073741670;
v6 = RtlCreateSecurityDescriptor(PoolWithTag, 1ui64);
if( v6 >= 0 )
{
v16 = 0;
v17 = 1280;
Sid = 257;
v18 = 18;
v7 = RtlLengthSid(&Sid) + 16;
v8 = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v7, 0x536C6F56ui64);
v9 = v8;
if( v8 )
{
v10 = RtlCreateAcl(v8, v7, 2u);
v11 = v9;
if( v10 >= 0 )
{
v10 = RtlpAddKnownAce(v9, 2ui64, 3ui64, 0x1FFFFFui64, &Sid, 0);
if( v10 >= 0 )
{
v10 = RtlSetDaclSecurityDescriptor(v5, 1u, v9, 0);
if( v10 >= 0 )
{
v10 = RtlSetControlSecurityDescriptor(
(PVOID *)v5,
(OBJECT_ATTRIBUTES *)0x1000,
0x1000ui64,
v12,
(UINT64)Src);
if( v10 >= 0 )
{
*SecurityDescriptor = v5;
result = 0;
*Acl = v9;
return result;
}
}
}
v11 = v9;
}
ExFreePoolWithTag(v11, 0);
v6 = v10;
}
else
{
v6 = -1073741670;
}
}
ExFreePoolWithTag(v5, 0);
return v6;
}Referenced by:
RtlCreateSystemVolumeInformationFolder