RtlpOwnerAcesPresent
UINT8 __stdcall RtlpOwnerAcesPresent(UINT8 AceFlags, _ACL *pAcl){
_WORD *SeOwnerRightsSid;
unsigned int AceCount;
_ACL *v5;
unsigned int v6;
int v7;
unsigned __int8 Sbz1;
unsigned int AclRevision;
__int64 v10;
_WORD *v11;
SeOwnerRightsSid = SeExports->SeOwnerRightsSid;
if( !pAcl )
return 0;
AceCount = pAcl->AceCount;
v5 = pAcl + 1;
v6 = 0;
if( !pAcl->AceCount )
return 0;
v7 = 104928;
while( 1 )
{
Sbz1 = v5->Sbz1;
if( (Sbz1 & 8) == 0 )
{
AclRevision = v5->AclRevision;
if( (unsigned __int8)AclRevision <= 0x10u && _bittest(&v7, AclRevision) )
{
v10 = 16i64 * (*(_DWORD *)&v5[1].AclRevision & 1) + ((8i64 * (*(_DWORD *)&v5[1].AclRevision & 2)) | 0xC);
}
else if( (_BYTE)AclRevision == 4 )
{
v10 = 12i64;
}
else
{
if( (unsigned __int8)AclRevision >= 0xBu && (unsigned __int8)(AclRevision - 13) > 1u )
goto LABEL_13;
v10 = 8i64;
}
v11 = (_WORD *)((char *)v5 + v10);
if( v11 )
{
if( *v11 == *SeOwnerRightsSid
&& !memcmp(v11, SeOwnerRightsSid, 4 * ((unsigned __int64)(unsigned __int16)*v11 >> 8) + 8)
&& (!AceFlags || (Sbz1 & AceFlags) != 0) )
{
return 1;
}
}
}
LABEL_13:
++v6;
v5 = (_ACL *)((char *)v5 + v5->AclSize);
if( v6 >= AceCount )
return 0;
}
}Referenced by:
RtlOwnerAcesPresent
RtlpNewSecurityObject
SeAccessCheckByTypeWithAdminlessChecks
SeComputeCreatorDeniedRights
SepCommonAccessCheckExWithAdminlessChecks