CmGetRegKeySecurityDescriptor

NTSTATUS __fastcall CmGetRegKeySecurityDescriptor(CHAR a1, CHAR **a2, UINT64 a3){
  INT64 *v5; 
  int Acl; 
  _DWORD *v7; 
  _DWORD *v8; 
  _DWORD *v9; 
  _DWORD *v10; 
  _DWORD *v11; 
  _DWORD *v12; 
  NTSTATUS v13; 
  int v14; 
  unsigned int v15; 
  VOID **PoolWithTag; 
  UINT64 v17; 
  _ACL *v18; 
  unsigned int v19; 
  VOID **v20; 
  CHAR *v21; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  _SID_IDENTIFIER_AUTHORITY v24; 
  _SID_IDENTIFIER_AUTHORITY v25; 
  __int128 SecurityDescriptor[2]; 
  __int64 v27; 
  char Owner[16]; 
  char Sid[12]; 
  INT64 v30; 
  INT64 v31[2]; 

  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  *a2 = 0i64;
  *(_DWORD *)IdentifierAuthority.Value = 0;
  *(_DWORD *)v24.Value = 0;
  *(_WORD *)&v24.Value[4] = 256;
  *(_DWORD *)v25.Value = 0;
  *(_WORD *)&v25.Value[4] = 3840;
  v27 = 0i64;
  v5 = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  Acl = RtlInitializeSid(Sid, &IdentifierAuthority, 1u);
  if( Acl >= 0 )
  {
    LODWORD(v7) = RtlSubAuthoritySid((INT64)Sid, 0i64);
    *v7 = 18;
    if( !RtlValidSid(Sid) )
      return -1073741762;
    Acl = RtlInitializeSid(&v30, &v24, 1u);
    if( Acl < 0 )
      return Acl;
    LODWORD(v8) = RtlSubAuthoritySid((INT64)&v30, 0i64);
    *v8 = 0;
    if( !RtlValidSid(&v30) )
      return -1073741762;
    Acl = RtlInitializeSid(Owner, &IdentifierAuthority, 2u);
    if( Acl < 0 )
      return Acl;
    LODWORD(v9) = RtlSubAuthoritySid((INT64)Owner, 0i64);
    *v9 = 32;
    LODWORD(v10) = RtlSubAuthoritySid((INT64)Owner, 1ui64);
    *v10 = 544;
    if( !RtlValidSid(Owner) )
      return -1073741762;
    if( a1 )
    {
      v5 = v31;
      Acl = RtlInitializeSid(v31, &v25, 2u);
      if( Acl < 0 )
        return Acl;
      LODWORD(v11) = RtlSubAuthoritySid((INT64)v31, 0i64);
      *v11 = 2;
      LODWORD(v12) = RtlSubAuthoritySid((INT64)v31, 1ui64);
      *v12 = 1;
      if( !RtlValidSid(v31) )
        return -1073741762;
    }
    v13 = RtlLengthSid((INT64)Owner);
    v14 = RtlLengthSid((INT64)&v30) + v13;
    v15 = RtlLengthSid((INT64)Sid) + v14 + 32;
    if( a1 )
      v15 += RtlLengthSid((INT64)v5) + 8;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v15, 1380994640i64);
    v18 = (_ACL *)PoolWithTag;
    if( PoolWithTag )
    {
      Acl = RtlCreateAcl((PACL)PoolWithTag, (_ACL)v15, 2ui64, v17);
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v18, 2ui64, 2ui64, 0xF003Fui64, Sid, 0);
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v18, 2ui64, 2ui64, 0x20019ui64, &v30, 0);
          if( Acl >= 0 )
          {
            Acl = RtlpAddKnownAce(v18, 2ui64, 2ui64, 0xF003Fui64, Owner, 0);
            if( Acl >= 0 )
            {
              if( !a1 || (Acl = RtlpAddKnownAce(v18, 2ui64, 2ui64, 0x20019ui64, v5, 0), Acl >= 0) )
              {
                Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
                if( Acl >= 0 )
                {
                  Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v18, 0);
                  if( Acl >= 0 )
                  {
                    Acl = RtlSetOwnerSecurityDescriptor(SecurityDescriptor, Owner, 1u);
                    if( Acl >= 0 )
                    {
                      Acl = RtlSetGroupSecurityDescriptor(SecurityDescriptor, Owner, 1u);
                      if( Acl >= 0 )
                      {
                        WORD1(SecurityDescriptor[0]) |= 0x1500u;
                        if( RtlValidSecurityDescriptor(SecurityDescriptor) )
                        {
                          v19 = RtlLengthSecurityDescriptor((INT64)SecurityDescriptor);
                          *(_DWORD *)IdentifierAuthority.Value = v19;
                          if( v19 < 0x28 )
                          {
                            Acl = -1073741762;
                          }
                          else
                          {
                            v20 = ExAllocatePoolWithTag(1ui64, v19, 1380994640i64);
                            v21 = (CHAR *)v20;
                            if( v20 )
                            {
                              Acl = RtlAbsoluteToSelfRelativeSD(
                                      SecurityDescriptor,
                                      v20,
                                      (UINT64 *)IdentifierAuthority.Value);
                              if( Acl >= 0 )
                              {
                                *a2 = v21;
                                v21 = 0i64;
                              }
                              if( v21 )
                                ExFreePoolWithTag(v21, 0);
                            }
                            else
                            {
                              Acl = -1073741801;
                            }
                          }
                        }
                        else
                        {
                          Acl = -1073741595;
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
      ExFreePoolWithTag(v18, 0);
    }
    else
    {
      return -1073741801;
    }
  }
  return Acl;
}

Referenced by: