SepInitProcessAuditSd

VOID __stdcall SepInitProcessAuditSd(){
  VOID **v0; 
  unsigned int v1; 
  VOID **PoolWithTag; 
  UINT64 v3; 
  VOID **v4; 
  _ACL *v5; 
  NTSTATUS Acl; 
  UINT64 v7; 
  void *v8; 
  int v9; 
  unsigned int v10; 
  VOID **v11; 
  UINT64 v12; 
  _ACL *v13; 
  BOOL v14; 
  BOOL v15; 

  v0 = 0i64;
  if( SepProcessAuditSd )
  {
    ExFreePoolWithTag(SepProcessAuditSd, 0);
    SepProcessAuditSd = 0i64;
  }
  if( (_DWORD)SepProcessAccessesToAudit )
  {
    v1 = 4 * *((unsigned __int8 *)SeWorldSid + 1) + 24;
    PoolWithTag = ExAllocatePoolWithTag(
                    1ui64,
                    4 * (unsigned int)*((unsigned __int8 *)SeWorldSid + 1) + 64,
                    1683187027i64);
    v4 = PoolWithTag;
    if( PoolWithTag )
    {
      v5 = (_ACL *)(PoolWithTag + 5);
      Acl = RtlCreateAcl((PACL)PoolWithTag + 5, (_ACL)v1, 2ui64, v3);
      if( Acl < 0 )
        goto LABEL_20;
      Acl = RtlAddAuditAccessAce(v5, v7, (PSID)(unsigned int)SepProcessAccessesToAudit, v8, v14, v15);
      if( Acl < 0 )
        goto LABEL_20;
      Acl = RtlCreateSecurityDescriptor(v4, 1ui64);
      if( Acl < 0 )
        goto LABEL_20;
      Acl = RtlSetSaclSecurityDescriptor(v4, 1u, v5, 0);
      if( Acl < 0 )
        goto LABEL_20;
      SepProcessAuditSd = v4;
      v9 = *((unsigned __int8 *)SeLocalSystemSid + 1)
         + *((unsigned __int8 *)SeLocalServiceSid + 1)
         + *((unsigned __int8 *)SeNetworkServiceSid + 1)
         + *((unsigned __int8 *)SeIUserSid + 1);
      v10 = 4 * v9 + 72;
      v11 = ExAllocatePoolWithTag(1ui64, (unsigned int)(4 * v9 + 112), 1683187027i64);
      v0 = v11;
      if( v11 )
      {
        v13 = (_ACL *)(v11 + 5);
        Acl = RtlCreateAcl((PACL)v11 + 5, (_ACL)v10, 2ui64, v12);
        if( Acl >= 0 )
        {
          Acl = RtlAddAccessAllowedAce(v13, 2ui64, 1, SeLocalSystemSid);
          if( Acl >= 0 )
          {
            Acl = RtlAddAccessAllowedAce(v13, 2ui64, 1, SeLocalServiceSid);
            if( Acl >= 0 )
            {
              Acl = RtlAddAccessAllowedAce(v13, 2ui64, 1, SeNetworkServiceSid);
              if( Acl >= 0 )
              {
                Acl = RtlAddAccessAllowedAce(v13, 2ui64, 1, SeIUserSid);
                if( Acl >= 0 )
                {
                  Acl = RtlCreateSecurityDescriptor(v0, 1ui64);
                  if( Acl >= 0 )
                  {
                    Acl = RtlSetDaclSecurityDescriptor(v0, 1u, v13, 0);
                    if( Acl >= 0 )
                    {
                      SepImportantProcessSd = (__int64)v0;
                      return;
                    }
                  }
                }
              }
            }
          }
        }
        goto LABEL_20;
      }
    }
    Acl = -1073741670;
LABEL_20:
    SepAuditFailed((unsigned int)Acl);
    if( v4 )
    {
      ExFreePoolWithTag(v4, 0);
      SepProcessAuditSd = 0i64;
    }
    if( v0 )
    {
      ExFreePoolWithTag(v0, 0);
      SepImportantProcessSd = 0i64;
    }
  }
}

Referenced by: