SeCaptureAcl

NTSTATUS __stdcall SeCaptureAcl(
        VOID *InputAcl,
        INT64 RequestorMode,
        VOID *PoolType,
        INT64 CapturedAcl,
        INT64 AlignedAclSize,
        INT64 ForceCapture,
        _ACL **CapturedAcla,
        UINT64 *AlignedAclSizea){
  __int64 v9; 
  __int64 v10; 
  size_t v11; 
  char *v12; 
  VOID **PoolWithTag; 

  if( (_BYTE)RequestorMode )
  {
    v9 = (__int64)InputAcl + 2;
    if( (unsigned __int64)InputAcl + 2 >= 0x7FFFFFFF0000i64 )
      v9 = 0x7FFFFFFF0000i64;
    v10 = *(unsigned __int16 *)v9;
    v11 = v10;
    if( (_DWORD)v10 )
    {
      if( ((unsigned __int8)InputAcl & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v12 = (char *)InputAcl + v10;
      if( (unsigned __int64)v12 > 0x7FFFFFFF0000i64 || v12 < InputAcl )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    v11 = *((unsigned __int16 *)InputAcl + 1);
  }
  if( v11 < 8 )
    return -1073741705;
  *(_DWORD *)AlignedAclSizea = (v11 + 3) & 0xFFFFFFFC;
  PoolWithTag = ExAllocatePoolWithTag((unsigned int)AlignedAclSize, v11, 1665230163i64);
  *CapturedAcla = (_ACL *)PoolWithTag;
  if( PoolWithTag )
  {
    memmove(PoolWithTag, InputAcl, v11);
    if( SepCheckAcl(*CapturedAcla, v11) )
      return 0;
    ExFreePoolWithTag(*CapturedAcla, 0);
    *CapturedAcla = 0i64;
    return -1073741705;
  }
  return -1073741670;
}

Referenced by: