RtlpSysVolCreateSecurityDescriptor
NTSTATUS __stdcall RtlpSysVolCreateSecurityDescriptor(VOID **SecurityDescriptor, _ACL **Acl){
VOID **PoolWithTag;
VOID **v5;
int v6;
unsigned int v7;
VOID **v8;
UINT64 v9;
_ACL *v10;
NTSTATUS v11;
_ACL *v12;
NTSTATUS result;
__int16 Sid;
int v15;
__int16 v16;
int v17;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1399615318i64);
v5 = PoolWithTag;
if( !PoolWithTag )
return -1073741670;
v6 = RtlCreateSecurityDescriptor(PoolWithTag, 1ui64);
if( v6 >= 0 )
{
v15 = 0;
v16 = 1280;
Sid = 257;
v17 = 18;
v7 = RtlLengthSid((INT64)&Sid) + 16;
v8 = ExAllocatePoolWithTag(1ui64, v7, 1399615318i64);
v10 = (_ACL *)v8;
if( v8 )
{
v11 = RtlCreateAcl((PACL)v8, (_ACL)v7, 2ui64, v9);
v12 = v10;
if( v11 >= 0 )
{
v11 = RtlpAddKnownAce(v10, 2ui64, 3ui64, 0x1FFFFFui64, &Sid, 0);
if( v11 >= 0 )
{
v11 = RtlSetDaclSecurityDescriptor(v5, 1u, v10, 0);
if( v11 >= 0 )
{
v11 = RtlSetControlSecurityDescriptor(v5, 0x1000u, 0x1000u);
if( v11 >= 0 )
{
*SecurityDescriptor = v5;
result = 0;
*Acl = v10;
return result;
}
}
}
v12 = v10;
}
ExFreePoolWithTag(v12, 0);
v6 = v11;
}
else
{
v6 = -1073741670;
}
}
ExFreePoolWithTag(v5, 0);
return v6;
}Referenced by:
RtlCreateSystemVolumeInformationFolder