CmpAdminSystemSecurityDescriptor

_ACL *__fastcall CmpAdminSystemSecurityDescriptor(){
  unsigned __int8 *Sid; 
  VOID **PoolWithTag; 
  unsigned __int8 *v2; 
  _DWORD *v3; 
  _DWORD *v4; 
  _DWORD *v5; 
  unsigned int v6; 
  size_t v7; 
  VOID **v8; 
  UINT64 v9; 
  _ACL *v10; 
  NTSTATUS Acl; 
  NTSTATUS v12; 
  VOID **v13; 
  _ACL *v14; 
  NTSTATUS SecurityDescriptor; 
  void *v16; 
  NTSTATUS v17; 
  void *v18; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 

  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  *(_DWORD *)IdentifierAuthority.Value = 0;
  Sid = (unsigned __int8 *)ExAllocatePoolWithTag(1ui64, 0xCui64, 538987843i64);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x10ui64, 538987843i64);
  v2 = (unsigned __int8 *)PoolWithTag;
  if( !Sid || !PoolWithTag )
    KeBugCheckEx(0x51u, (PVOID)0xB, (PVOID)1, 0i64, 0i64);
  if( RtlInitializeSid(Sid, &IdentifierAuthority, 1u) < 0 || RtlInitializeSid(v2, &IdentifierAuthority, 2u) < 0 )
    KeBugCheckEx(0x51u, (PVOID)0xB, (PVOID)2, 0i64, 0i64);
  LODWORD(v3) = RtlSubAuthoritySid((INT64)Sid, 0i64);
  *v3 = 18;
  LODWORD(v4) = RtlSubAuthoritySid((INT64)v2, 0i64);
  *v4 = 32;
  LODWORD(v5) = RtlSubAuthoritySid((INT64)v2, 1ui64);
  *v5 = 544;
  v6 = 4 * (Sid[1] + v2[1]) + 40;
  v7 = v6;
  v8 = ExAllocatePoolWithTag(1ui64, v6, 538987843i64);
  v10 = (_ACL *)v8;
  if( !v8 )
    KeBugCheckEx(0x51u, (PVOID)0xB, (PVOID)3, 0i64, 0i64);
  Acl = RtlCreateAcl((PACL)v8, (_ACL)v6, 2ui64, v9);
  if( Acl < 0 )
    KeBugCheckEx(0x51u, (PVOID)0xB, (PVOID)4, (PVOID)Acl, 0i64);
  v12 = RtlpAddKnownAce(v10, 2ui64, 0i64, 0x1F01FFui64, Sid, 0);
  if( v12 < 0 || (v12 = RtlpAddKnownAce(v10, 2ui64, 0i64, 0x1F01FFui64, v2, 0), v12 < 0) )
    KeBugCheckEx(0x51u, (PVOID)0xB, (PVOID)5, (PVOID)v12, 0i64);
  v13 = ExAllocatePoolWithTag(1ui64, v6 + 40i64, 538987843i64);
  v14 = (_ACL *)v13;
  if( !v13 )
    KeBugCheckEx(0x51u, (PVOID)0xB, (PVOID)6, 0i64, 0i64);
  memmove(v13 + 5, v10, v7);
  SecurityDescriptor = RtlCreateSecurityDescriptor(v14, 1ui64);
  v16 = (void *)SecurityDescriptor;
  if( SecurityDescriptor < 0 )
  {
    ExFreePoolWithTag(v14, 0);
    KeBugCheckEx(0x51u, (PVOID)0xB, (PVOID)7, v16, 0i64);
  }
  v17 = RtlSetDaclSecurityDescriptor(v14, 1u, v14 + 5, 0);
  v18 = (void *)v17;
  if( v17 < 0 )
  {
    ExFreePoolWithTag(v14, 0);
    KeBugCheckEx(0x51u, (PVOID)0xB, (PVOID)8, v18, 0i64);
  }
  ExFreePoolWithTag(Sid, 0);
  ExFreePoolWithTag(v2, 0);
  ExFreePoolWithTag(v10, 0);
  return v14;
}

Referenced by: