RtlpSysVolCheckOwnerAndSecurity

NTSTATUS __stdcall RtlpSysVolCheckOwnerAndSecurity(
        VOID *Handle,
        PACL StandardAcl,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  NTSTATUS v8; 
  VOID **PoolWithTag; 
  int SecurityObject; 
  VOID **v13; 
  unsigned int i; 
  NTSTATUS v15; 
  _BYTE *v16; 
  char v17; 
  VOID **v18; 
  NTSTATUS SelfRelativeSD; 
  size_t v21; 
  int v22; 
  VOID **v23; 
  VOID **v24; 
  int v25; 
  VOID **v26; 
  UINT64 NumberOfBytes; 
  PACL Dacl; 
  PVOID Ace; 
  PVOID Owner; 
  __int16 Sid2; 
  int v32; 
  __int16 v33; 
  int v34; 
  int v35; 
  __int16 v36; 
  int v37; 
  __int16 v38; 
  int v39; 

  v8 = 0;
  LODWORD(NumberOfBytes) = 0;
  Owner = 0i64;
  BYTE4(NumberOfBytes) = 0;
  Ace = 0i64;
  Dacl = 0i64;
  if( NtQuerySecurityObject((UINT64)Handle, 5i64, 0i64, 0i64, (UINT64)&NumberOfBytes) != -1073741789 )
    return 0;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1399615318i64);
  if( !PoolWithTag )
    return -1073741670;
  SecurityObject = NtQuerySecurityObject(
                     (UINT64)Handle,
                     5i64,
                     (UINT64)PoolWithTag,
                     (unsigned int)NumberOfBytes,
                     (UINT64)&NumberOfBytes);
  v13 = PoolWithTag;
  if( SecurityObject < 0 )
    goto LABEL_24;
  SecurityObject = RtlGetDaclSecurityDescriptor(
                     PoolWithTag,
                     (UINT8 *)&NumberOfBytes + 4,
                     &Dacl,
                     (UINT8 *)&NumberOfBytes + 5);
  v13 = PoolWithTag;
  if( SecurityObject < 0 )
    goto LABEL_24;
  SecurityObject = RtlGetOwnerSecurityDescriptor(PoolWithTag, &Owner, (UINT8 *)&NumberOfBytes + 5);
  if( SecurityObject < 0 )
  {
    v13 = PoolWithTag;
LABEL_24:
    ExFreePoolWithTag(v13, 0);
    return SecurityObject;
  }
  v37 = 0;
  v32 = 0;
  v36 = 257;
  v38 = 1280;
  v39 = 18;
  Sid2 = 513;
  v33 = 1280;
  v34 = 32;
  v35 = 544;
  if( Owner && RtlEqualSid(Owner, &Sid2) && BYTE4(NumberOfBytes) && Dacl )
  {
    for( i = 0; ; ++i )
    {
      v15 = RtlGetAce(Dacl, i, &Ace);
      v16 = Ace;
      if( v15 < 0 )
        v16 = 0i64;
      Ace = v16;
      if( !v16 )
        break;
      if( !*v16 && RtlEqualSid(v16 + 8, &v36) )
      {
        v17 = v16[1];
        if( (v17 & 1) == 0 || (v17 & 2) == 0 )
        {
          v16[1] = v17 | 3;
          SelfRelativeSD = NtSetSecurityObject((UINT64)Handle, 4ui64, (INT64)PoolWithTag);
          goto LABEL_26;
        }
        goto LABEL_18;
      }
    }
  }
  v21 = NumberOfBytes;
  if( RtlSelfRelativeToAbsoluteSD2(PoolWithTag, &NumberOfBytes) != -1073741789 )
    goto LABEL_30;
  v22 = NumberOfBytes;
  v23 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1399615318i64);
  v24 = v23;
  if( !v23 )
    goto LABEL_37;
  memmove(v23, PoolWithTag, v21);
  ExFreePoolWithTag(PoolWithTag, 0);
  LODWORD(NumberOfBytes) = v22;
  PoolWithTag = v24;
  v25 = RtlSelfRelativeToAbsoluteSD2(v24, &NumberOfBytes);
  if( v25 >= 0 )
  {
LABEL_30:
    SelfRelativeSD = RtlSetOwnerSecurityDescriptor(PoolWithTag, &Sid2, 0);
    if( SelfRelativeSD < 0
      || (SelfRelativeSD = RtlSetDaclSecurityDescriptor(PoolWithTag, 1u, StandardAcl, 0), SelfRelativeSD < 0)
      || (LODWORD(NumberOfBytes) = 0,
          SelfRelativeSD = RtlMakeSelfRelativeSD(PoolWithTag, 0i64, &NumberOfBytes),
          SelfRelativeSD != -1073741789) )
    {
LABEL_26:
      v8 = SelfRelativeSD;
LABEL_18:
      v18 = PoolWithTag;
LABEL_19:
      ExFreePoolWithTag(v18, 0);
      return v8;
    }
    v26 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1399615318i64);
    v24 = v26;
    if( v26 )
    {
      v25 = RtlMakeSelfRelativeSD(PoolWithTag, v26, &NumberOfBytes);
      ExFreePoolWithTag(PoolWithTag, 0);
      if( v25 >= 0 )
      {
        v8 = NtSetSecurityObject((UINT64)Handle, 5ui64, (INT64)v24);
        v18 = v24;
        goto LABEL_19;
      }
      goto LABEL_36;
    }
LABEL_37:
    v8 = -1073741670;
    goto LABEL_18;
  }
LABEL_36:
  ExFreePoolWithTag(v24, 0);
  return v25;
}

Referenced by: