LocalGetAclForString
NTSTATUS __stdcall LocalGetAclForString(WCHAR *AclString, UINT8 ConvertAsDacl, _ACL **Acl, WCHAR **End){
_ACL **v5;
WCHAR *v7;
NTSTATUS RelativeAttributeForString;
VOID *v9;
NTSTATUS result;
WCHAR *v11;
__int64 v12;
WCHAR *v13;
UINT8 v14;
UINT64 v15;
int v16;
unsigned int v17;
_ACL *v18;
__int16 v19;
unsigned int v20;
WCHAR v21;
WCHAR v22;
WCHAR *v23;
unsigned int v24;
_STRSD_KEY_LOOKUP *v25;
unsigned int v26;
__int64 v27;
WCHAR *v28;
WCHAR *v29;
WCHAR **v30;
WCHAR v31;
UINT64 v32;
_STRSD_KEY_LOOKUP *v33;
__int64 v34;
int v35;
NTSTATUS SidForString;
WCHAR *v37;
WCHAR *i;
int v39;
unsigned int v40;
unsigned int v41;
unsigned int v42;
unsigned int v43;
NTSTATUS v44;
UINT64 v45;
unsigned int v46;
UINT64 v47;
PVOID *v48;
UINT64 v49;
_ACL *v50;
NTSTATUS v51;
NTSTATUS v52;
_WORD *v53;
_STRSD_KEY_LOOKUP *v54;
_ACL *v55;
bool v56;
int v57;
unsigned int v58;
bool v59;
unsigned __int64 v60;
unsigned int v61;
_WORD *v62;
const VOID **v63;
void *v64;
_ACL *v65;
unsigned int v66;
_WORD *v67;
char v68;
size_t v69;
int v70;
char *v71;
unsigned int v72;
unsigned int v73;
unsigned int v74;
unsigned int v75;
unsigned int v76;
int v77;
char *v78;
unsigned int v79;
size_t v80;
unsigned int v81;
const VOID *v82;
char *v83;
VOID *v84;
unsigned int v85;
VOID *Sid;
UINT64 NewType;
UINT8 NewTypea;
unsigned __int8 v89;
int v90;
char FreeSid[8];
VOID *SID;
unsigned int AccessMask;
char AccessMask_4;
UINT64 Size;
const VOID **RelativeAttributeSize_4;
PVOID P;
UINT64 AceCount;
WCHAR *Enda;
UINT8 UseNonPagedPool[4];
int v101;
_GUID *InheritedObjectTypeGuid;
_GUID *ObjectTypeGuid;
PVOID v104;
UINT64 LookupFlags;
WCHAR *endptr;
PVOID Ace;
WCHAR **v108;
int v109;
unsigned __int16 v110;
_GUID Guid;
_GUID v112;
WCHAR Dst[40];
v108 = End;
RelativeAttributeSize_4 = (const VOID **)Acl;
LODWORD(AceCount) = 0;
v5 = Acl;
endptr = 0i64;
FreeSid[0] = 0;
v7 = AclString;
SID = 0i64;
RelativeAttributeForString = 0;
P = 0i64;
v9 = 0i64;
Size = 0i64;
v104 = 0i64;
Ace = 0i64;
Enda = 0i64;
v109 = 0;
v110 = 256;
if( !AclString || !Acl || !End )
return 87;
if( !wcsnicmp(AclString, L"NO_ACCESS_CONTROL", 0x11u) )
{
*v5 = 0i64;
*End = v7 + 17;
goto LABEL_87;
}
LODWORD(LookupFlags) = 2 - (ConvertAsDacl != 0);
result = LocalGetSDDLDeliminator(v7, End);
if( result )
return result;
v11 = *End;
if( *End == v7 )
return 87;
if( v11 )
{
v13 = v11 - 1;
}
else
{
v12 = -1i64;
do
++v12;
while( v7[v12] );
v13 = &v7[v12];
}
*End = v13;
RelativeAttributeForString = LocalGetAceCount(v7, v13, &AceCount);
if( RelativeAttributeForString )
goto LABEL_87;
v16 = AceCount;
if( !(_DWORD)AceCount )
{
v55 = (_ACL *)SddlpAlloc(8ui64, v14, v15);
*v5 = v55;
if( !v55 )
return 8;
v55->AclRevision = 2;
(*v5)->Sbz1 = 0;
(*v5)->AclSize = 8;
(*v5)->AceCount = 0;
(*v5)->Sbz2 = 0;
return RelativeAttributeForString;
}
v17 = 84 * AceCount + 8;
if( v17 > 0xFFFF )
v17 = 0xFFFF;
*(_DWORD *)UseNonPagedPool = v17;
v18 = (_ACL *)SddlpAlloc(v17, v14, v15);
*v5 = v18;
if( !v18 )
{
RelativeAttributeForString = 8;
goto LABEL_87;
}
v18->AclRevision = 2;
v19 = 8;
v90 = 8;
(*v5)->Sbz1 = 0;
(*v5)->AclSize = v17;
(*v5)->AceCount = 0;
(*v5)->Sbz2 = 0;
v101 = 0;
if( !v16 )
goto LABEL_84;
while( 2 )
{
v89 = 0;
AccessMask = 0;
Guid = 0i64;
v20 = 0;
ObjectTypeGuid = 0i64;
v112 = 0i64;
InheritedObjectTypeGuid = 0i64;
while( 1 )
{
v21 = *v7;
if( *v7 != 32 )
break;
++v7;
}
v22 = *v7;
if( v21 == 40 )
v22 = v7[1];
v23 = v7 + 1;
if( v21 != 40 )
v23 = v7;
if( v22 == 32 )
{
do
++v23;
while( *v23 == 32 );
}
v24 = LookupFlags;
v25 = LookupAceTypeInTable(v23, 0i64, (unsigned int)LookupFlags);
if( !v25 )
{
RelativeAttributeForString = 1804;
goto LABEL_83;
}
v26 = *((unsigned __int8 *)v25 + 12);
v27 = (unsigned int)v25[2];
AccessMask_4 = v26;
v28 = &v23[v27];
if( *v28 != 59 && *v28 != 32 )
goto LABEL_110;
v29 = v28 + 1;
if( (unsigned __int8)(v26 - 5) <= 3u || (_BYTE)v26 == 11 )
(*v5)->AclRevision = 4;
while( *v29 == 32 )
++v29;
v30 = v108;
while( 1 )
{
if( v29 == *v30 )
goto LABEL_33;
if( *v29 == 59 )
break;
for( ; *v29 == 32; ++v29 )
;
v54 = LookupAceFlagsInTable(v29, 0i64, v24);
if( !v54 )
{
RelativeAttributeForString = 1004;
goto LABEL_83;
}
v89 |= *((_BYTE *)v54 + 12);
v29 += (unsigned int)v54[2];
}
do
{
++v29;
LABEL_33:
v31 = *v29;
}
while( *v29 == 32 );
while( v31 != 59 )
{
if( v31 == 32 )
{
do
++v29;
while( *v29 == 32 );
}
v32 = v24;
if( (_BYTE)v26 == 17 )
v32 = 4i64;
v33 = LookupAccessMaskInTable(v29, 0i64, v32);
if( v33 )
{
v20 |= v33[3];
v34 = (unsigned int)v33[2];
AccessMask = v20;
v29 += v34;
}
else
{
v20 |= wcstoul(v29, &endptr, 0i64);
AccessMask = v20;
if( endptr == v29 )
goto LABEL_110;
v29 = endptr;
}
v31 = *v29;
}
v35 = 0;
LABEL_42:
++v29;
while( 1 )
{
if( *v29 == 32 )
goto LABEL_42;
if( *v29 != 59 )
break;
LABEL_45:
++v29;
if( (unsigned int)++v35 >= 2 )
goto LABEL_46;
}
if( (unsigned __int8)(v26 - 5) > 3u && (_BYTE)v26 != 11 )
goto LABEL_110;
wcsncpy_s(Dst, 0x25ui64, v29, 0x24ui64);
Dst[36] = 0;
if( !v35 )
{
if( !SddlpUuidFromString(Dst, &Guid) )
goto LABEL_126;
ObjectTypeGuid = &Guid;
goto LABEL_124;
}
if( SddlpUuidFromString(Dst, &v112) )
{
InheritedObjectTypeGuid = &v112;
LABEL_124:
v29 += 36;
if( *v29 != 59 && *v29 != 32 )
{
LABEL_126:
RelativeAttributeForString = 1705;
goto LABEL_83;
}
goto LABEL_45;
}
RelativeAttributeForString = 1705;
LABEL_46:
if( RelativeAttributeForString )
goto LABEL_83;
while( *v29 == 32 )
++v29;
SidForString = LocalGetSidForString(v29, &SID, &Enda, (UINT8 *)FreeSid, Sid, NewType);
v9 = SID;
RelativeAttributeForString = SidForString;
if( SidForString )
goto LABEL_83;
v37 = Enda;
if( !Enda || !SID )
{
LABEL_110:
RelativeAttributeForString = 1336;
LABEL_83:
v19 = v90;
goto LABEL_84;
}
for( i = Enda; *i == 32; ++i )
;
if( (unsigned __int8)v26 > 0x15u || (v39 = 2371072, !_bittest(&v39, v26)) )
{
v40 = Size;
v41 = HIDWORD(Size);
goto LABEL_55;
}
if( *i == 59 )
{
do
++i;
while( *i == 32 );
if( *i == 40 )
{
if( P )
{
ExFreePoolWithTag(P, 0);
P = 0i64;
}
LODWORD(Size) = 0;
if( v104 )
{
ExFreePoolWithTag(v104, 0);
v104 = 0i64;
}
HIDWORD(Size) = 0;
if( (_BYTE)v26 == 18 )
{
NewType = 0i64;
Sid = 0i64;
RelativeAttributeForString = LocalGetRelativeAttributeForString(
i,
&Enda,
(_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 **)&v104,
(UINT64 *)((char *)&Size + 4));
if( RelativeAttributeForString )
{
LABEL_155:
v19 = v90;
goto LABEL_84;
}
}
else
{
NewType = 0i64;
Sid = 0i64;
RelativeAttributeForString = LocalGetConditionForString(i, (INT64)&Enda, (UINT8 **)&P, &Size);
}
v37 = Enda;
}
else
{
v37 = i;
Enda = i;
}
}
v40 = Size;
v41 = HIDWORD(Size);
if( !Size )
goto LABEL_154;
if( RelativeAttributeForString )
goto LABEL_155;
LABEL_55:
while( *v37 == 32 )
Enda = ++v37;
if( *v37 != 41 )
goto LABEL_154;
v7 = v37 + 1;
v42 = v26;
if( v26 > 0x11 )
{
if( v26 == 18 )
{
v43 = v41 + 12;
v59 = v41 + 12 < v41;
goto LABEL_171;
}
if( v26 == 19 || v26 == 20 )
{
LABEL_60:
v43 = 12;
goto LABEL_61;
}
v56 = v26 == 21;
LABEL_153:
if( v56 )
{
LABEL_162:
if( v40 > 0xFFFFFFFC )
goto LABEL_163;
v58 = (v40 + 3) & 0xFFFFFFFC;
v43 = v58 + 12;
LABEL_161:
v59 = v43 < v58;
LABEL_171:
if( v59 )
{
RelativeAttributeForString = 534;
goto LABEL_83;
}
LABEL_61:
v44 = RtlLengthSid((INT64)v9);
v19 = v90;
v46 = v43 + v44 - 4;
if( v46 < v43 )
{
RelativeAttributeForString = 534;
}
else
{
if( v46 + v90 >= v46 )
{
v47 = *(unsigned int *)UseNonPagedPool;
if( v46 + v90 > *(_DWORD *)UseNonPagedPool )
{
v60 = v46 * (unsigned __int64)(unsigned int)(AceCount - v101);
if( v60 > 0xFFFFFFFF
|| (v61 = v60 + *(_DWORD *)UseNonPagedPool, (int)v60 + *(_DWORD *)UseNonPagedPool < (unsigned int)v60) )
{
v9 = SID;
RelativeAttributeForString = 534;
goto LABEL_83;
}
v62 = SddlpAlloc(v61, UseNonPagedPool[0], v45);
v63 = RelativeAttributeSize_4;
v64 = (void *)*RelativeAttributeSize_4;
if( !v62 )
{
if( v64 )
{
ExFreePoolWithTag(v64, 0);
v63 = RelativeAttributeSize_4;
}
v56 = FreeSid[0] == 1;
*v63 = 0i64;
if( v56 )
{
if( SID )
ExFreePoolWithTag(SID, 0);
v9 = 0i64;
FreeSid[0] = 0;
}
else
{
v9 = SID;
}
RelativeAttributeForString = 8;
goto LABEL_83;
}
memmove(v62, *RelativeAttributeSize_4, *(size_t *)UseNonPagedPool);
v48 = (PVOID *)RelativeAttributeSize_4;
v62[1] = v61;
if( *v48 )
{
ExFreePoolWithTag(*v48, 0);
v48 = (PVOID *)RelativeAttributeSize_4;
}
*v48 = v62;
v40 = Size;
*(_DWORD *)UseNonPagedPool = v61;
}
else
{
v48 = (PVOID *)RelativeAttributeSize_4;
}
v90 += v46;
if( v42 > 0xB )
{
v72 = v42 - 13;
if( !v72 )
goto LABEL_229;
v73 = v72 - 4;
if( !v73 )
{
v9 = SID;
LODWORD(NewType) = AccessMask;
v51 = SddlAddMandatoryAce((_ACL *)*v48, v47, v89, SID, (UINT8)Sid, NewType);
goto LABEL_71;
}
v74 = v73 - 1;
if( v74 )
{
v75 = v74 - 1;
if( !v75 )
{
v9 = SID;
v51 = SddlAddScopedPolicyIDAce((PACL)*v48, v47, v89, (VOID *)AccessMask, SID);
goto LABEL_71;
}
v76 = v75 - 1;
if( !v76 )
{
v9 = SID;
LODWORD(NewType) = AccessMask;
v51 = SddlAddProcessTrustLabelAce((_ACL *)*v48, v47, v89, SID, (UINT8)Sid, NewType);
goto LABEL_71;
}
if( v76 != 1 )
{
LABEL_185:
v9 = SID;
v52 = -1073741811;
LABEL_247:
RelativeAttributeForString = RtlNtStatusToDosError((unsigned int)v52);
goto LABEL_83;
}
v9 = SID;
if( v40 < 0xFFFF )
{
LODWORD(NewType) = AccessMask;
v51 = SddlAddAccessFilterAce((PACL)*v48, v47, v89, (INT64)SID, (INT64)Sid, NewType, P, v40);
goto LABEL_71;
}
}
else
{
if( v46 >= 0xFFFF )
{
LABEL_245:
v9 = SID;
goto LABEL_246;
}
v9 = SID;
if( (v89 & 0xE0) == 0 && !AccessMask )
{
v77 = *(_DWORD *)((char *)SID + 2) - v109;
if( !v77 )
v77 = *((unsigned __int16 *)SID + 3) - v110;
if( !v77 && *((_BYTE *)SID + 1) == 1 && !*((_DWORD *)SID + 2) )
{
v78 = (char *)SddlpAlloc(v46, v47, v45);
if( v78 )
{
*v78 = AccessMask_4;
v78[1] = v89;
*((_WORD *)v78 + 1) = v46;
*((_DWORD *)v78 + 1) = 0;
v79 = RtlLengthSid((INT64)v9);
RtlCopySid(v79, v78 + 8, v9);
if( HIDWORD(Size) )
{
v80 = HIDWORD(Size);
v81 = RtlLengthSid((INT64)v9);
v82 = v104;
LABEL_233:
memmove(&v78[v81 + 8], v82, v80);
}
LABEL_234:
LODWORD(Sid) = v46;
v52 = RtlAddAce((PACL)*RelativeAttributeSize_4, 2ui64, 0xFFFFFFFFui64, v78, (UINT64)Sid);
ExFreePoolWithTag(v78, 0);
goto LABEL_72;
}
LABEL_227:
v52 = -1073741801;
goto LABEL_72;
}
}
}
}
else
{
if( v42 != 11 )
{
switch( v42 )
{
case 0u:
NewTypea = 0;
LABEL_69:
v49 = v89;
v50 = (_ACL *)*v48;
LABEL_70:
v9 = SID;
v51 = RtlpAddKnownAce(v50, 2ui64, v49, AccessMask, SID, NewTypea);
LABEL_71:
v52 = v51;
goto LABEL_72;
case 1u:
NewTypea = 1;
goto LABEL_69;
case 2u:
v65 = (_ACL *)*v48;
NewTypea = 2;
v66 = v89 & 0x3F | 0x40;
if( (v89 & 0x40) == 0 )
v66 = v89 & 0x3F;
v50 = v65;
v49 = v66;
LODWORD(v49) = v66 | 0x80;
if( (v89 & 0x80u) == 0 )
v49 = v66;
goto LABEL_70;
case 5u:
v9 = SID;
v51 = RtlAddAccessAllowedObjectAce(
(PACL)*v48,
4ui64,
v89,
AccessMask,
ObjectTypeGuid,
InheritedObjectTypeGuid,
SID);
goto LABEL_71;
case 6u:
v9 = SID;
v51 = RtlAddAccessDeniedObjectAce(
(PACL)*v48,
4ui64,
v89,
AccessMask,
ObjectTypeGuid,
InheritedObjectTypeGuid,
SID);
goto LABEL_71;
case 7u:
v9 = SID;
v51 = RtlAddAuditAccessObjectAce(
(PACL)*v48,
4ui64,
v89,
AccessMask,
ObjectTypeGuid,
InheritedObjectTypeGuid,
SID,
v89 & 0x40,
v89 & 0x80);
goto LABEL_71;
}
if( v42 <= 8 )
goto LABEL_185;
LABEL_229:
if( v46 < 0xFFFF )
{
v83 = (char *)SddlpAlloc(v46, v47, v45);
v9 = SID;
v78 = v83;
if( v83 )
{
v84 = SID;
*v83 = AccessMask_4;
*((_DWORD *)v83 + 1) = AccessMask;
v83[1] = v89;
*((_WORD *)v83 + 1) = v46;
v85 = RtlLengthSid((INT64)v84);
RtlCopySid(v85, v78 + 8, v9);
if( (_DWORD)Size )
{
v80 = Size;
v81 = RtlLengthSid((INT64)v9);
v82 = P;
goto LABEL_233;
}
goto LABEL_234;
}
goto LABEL_227;
}
goto LABEL_245;
}
v9 = SID;
if( v46 < 0xFFFF )
{
v52 = RtlAddAccessAllowedObjectAce(
(PACL)*v48,
4ui64,
v89,
AccessMask,
ObjectTypeGuid,
InheritedObjectTypeGuid,
SID);
if( v52 < 0 )
goto LABEL_247;
v52 = RtlGetAce(
(PACL)*RelativeAttributeSize_4,
(unsigned int)*((unsigned __int16 *)*RelativeAttributeSize_4 + 2) - 1,
&Ace);
if( v52 < 0 )
goto LABEL_247;
v67 = Ace;
v68 = 9;
if( *(_BYTE *)Ace == 5 )
v68 = 11;
*(_BYTE *)Ace = v68;
v67[1] = v46;
if( (_DWORD)Size )
{
v69 = Size;
if( *(_BYTE *)v67 == 11 )
{
v70 = *((_DWORD *)v67 + 2);
v71 = (char *)&v67[8 * (v70 & 1) + 6 + 4 * (v70 & 2)] + (unsigned int)RtlLengthSid((INT64)SID);
}
else
{
v71 = (char *)v67 + (unsigned int)RtlLengthSid((INT64)SID) + 8;
}
memmove(v71, P, v69);
}
v9 = SID;
LABEL_72:
if( v52 >= 0 )
{
if( FreeSid[0] == 1 )
ExFreePoolWithTag(v9, 0);
v9 = 0i64;
SID = 0i64;
if( P )
{
ExFreePoolWithTag(P, 0);
P = 0i64;
}
LODWORD(Size) = 0;
if( v104 )
{
ExFreePoolWithTag(v104, 0);
v104 = 0i64;
}
HIDWORD(Size) = 0;
if( *v7 == 40 )
++v7;
if( ++v101 < (unsigned int)AceCount )
{
v5 = (_ACL **)RelativeAttributeSize_4;
continue;
}
goto LABEL_83;
}
goto LABEL_247;
}
}
LABEL_246:
v52 = -1073741705;
goto LABEL_247;
}
v9 = SID;
RelativeAttributeForString = 534;
}
LABEL_84:
v53 = *RelativeAttributeSize_4;
if( RelativeAttributeForString )
{
if( v53 )
ExFreePoolWithTag((PVOID)*RelativeAttributeSize_4, 0);
*RelativeAttributeSize_4 = 0i64;
}
else
{
v53[1] = v19;
}
if( FreeSid[0] && v9 )
ExFreePoolWithTag(v9, 0);
goto LABEL_87;
}
LABEL_154:
RelativeAttributeForString = 1336;
goto LABEL_155;
}
break;
}
if( v26 == 17 || v26 <= 3 )
goto LABEL_60;
if( v26 <= 4 )
goto LABEL_154;
if( v26 <= 8 )
{
v43 = ObjectTypeGuid != 0i64 ? 32 : 16;
if( InheritedObjectTypeGuid )
v43 = ObjectTypeGuid != 0i64 ? 48 : 32;
goto LABEL_61;
}
if( v26 <= 0xA )
goto LABEL_162;
if( v26 != 11 )
{
v56 = v26 == 13;
goto LABEL_153;
}
v57 = ObjectTypeGuid != 0i64 ? 48 : 32;
if( !InheritedObjectTypeGuid )
v57 = ObjectTypeGuid != 0i64 ? 32 : 16;
if( v40 <= 0xFFFFFFFC )
{
v58 = (v40 + 3) & 0xFFFFFFFC;
v43 = v58 + v57;
goto LABEL_161;
}
LABEL_163:
RelativeAttributeForString = 534;
LABEL_87:
if( P )
ExFreePoolWithTag(P, 0);
if( v104 )
ExFreePoolWithTag(v104, 0);
return RelativeAttributeForString;
}Referenced by:
LocalConvertStringSDToSD_Rev1