SeCaptureAcl

INT64 __fastcall SeCaptureAcl(
        _ACL *InputAcl,
        CHAR RequestorMode,
        VOID *CaptureBuffer,
        UINT64 CaptureBufferLength,
        _POOL_TYPE PoolType,
        UINT8 ForceCapture,
        _ACL **CapturedAcl,
        UINT64 *AlignedAclSize){
  __int64 p_AclSize; 
  __int64 v10; 
  unsigned int AclSize; 
  char *v12; 
  _ACL *PoolWithTag; 
  if( RequestorMode )
  {
    p_AclSize = (__int64)&InputAcl->AclSize;
    if( (unsigned __int64)&InputAcl->AclSize >= 0x7FFFFFFF0000i64 )
      p_AclSize = 0x7FFFFFFF0000i64;
    v10 = *(unsigned __int16 *)p_AclSize;
    AclSize = v10;
    if( (_DWORD)v10 )
    {
      if( ((unsigned __int8)InputAcl & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v12 = (char *)InputAcl + v10;
      if( (unsigned __int64)v12 > 0x7FFFFFFF0000i64 || v12 < (char *)InputAcl )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    AclSize = InputAcl->AclSize;
  }
  if( AclSize < 8 )
    return 3221225591i64;
  *(_DWORD *)AlignedAclSize = (AclSize + 3) & 0xFFFFFFFC;
  PoolWithTag = (_ACL *)ExAllocatePoolWithTag(PoolType, AclSize, 0x63416553ui64);
  *CapturedAcl = PoolWithTag;
  if( PoolWithTag )
  {
    memmove((UINT8 *)PoolWithTag, (UINT8 *)InputAcl, AclSize);
    if( SepCheckAcl(*CapturedAcl, AclSize) )
      return 0i64;
    ExFreePoolWithTag(*CapturedAcl, 0);
    *CapturedAcl = 0i64;
    return 3221225591i64;
  }
  return 3221225626i64;
}

Referenced by: