CmpGenerateAppHiveSecurityDescriptor

CHAR *__fastcall CmpGenerateAppHiveSecurityDescriptor(){
  __int64 v0; 
  VOID *v1; 
  CHAR *v2; 
  VOID *v3; 
  VOID *v4; 
  UINT64 v5; 
  UINT64 v6; 
  UINT64 v7; 
  VOID **PoolWithTag; 
  PSID Sid; 
  PSID NewType; 
  UINT64 BufferLength; 
  PVOID P; 
  VOID *TokenInformation; 
  __int128 SecurityDescriptor[2]; 
  __int64 v16; 
  _ACL Sacl[12]; 
  _ACL Acl[30]; 

  v1 = *(VOID **)(v0 + 16);
  memset(Acl, 0i64, 0xECu);
  v16 = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  memset(Sacl, 0i64, 0x54u);
  P = 0i64;
  v2 = 0i64;
  TokenInformation = 0i64;
  RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  if( SeQueryInformationToken(v1, TokenOwner, &TokenInformation) >= 0
    && SeQueryInformationToken(v1, TokenPrimaryGroup, &P) >= 0 )
  {
    v3 = *(VOID **)TokenInformation;
    v4 = *(VOID **)P;
    RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    RtlSetOwnerSecurityDescriptor(SecurityDescriptor, v3, 0);
    RtlSetGroupSecurityDescriptor(SecurityDescriptor, v4, 0);
    RtlCreateAcl(Acl, (_ACL)236i64, 2ui64, v5);
    RtlpAddKnownAce(Acl, 2ui64, 2ui64, 0xF003Fui64, SeWorldSid, 0);
    RtlpAddKnownAce(Acl, 2ui64, 2ui64, 0xF003Fui64, SeAllAppPackagesSid, 0);
    RtlpAddKnownAce(Acl, 2ui64, 2ui64, 0xF003Fui64, *(VOID **)&SeRestrictedSid, 0);
    RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, Acl, 0);
    RtlCreateAcl(Sacl, (_ACL)84i64, 2ui64, v6);
    LODWORD(NewType) = 1;
    RtlAddMandatoryAce(Sacl, v7, 0i64, (UINT64)SeLowMandatorySid, Sid, NewType);
    RtlSetSaclSecurityDescriptor(SecurityDescriptor, 1u, Sacl, 0);
    LODWORD(BufferLength) = 0;
    RtlAbsoluteToSelfRelativeSD(SecurityDescriptor, 0i64, &BufferLength);
    PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)BufferLength, 1699966275i64);
    v2 = (CHAR *)PoolWithTag;
    if( PoolWithTag )
      RtlAbsoluteToSelfRelativeSD(SecurityDescriptor, PoolWithTag, &BufferLength);
  }
  if( P )
    ExFreePoolWithTag(P, 0);
  if( TokenInformation )
    ExFreePoolWithTag(TokenInformation, 0);
  return v2;
}

Referenced by: