RtlpAddKnownObjectAce

INT64 __stdcall RtlpAddKnownObjectAce(
        _ACL *Acl,
        UINT64 AceRevision,
        UINT64 AceFlags,
        UINT64 AccessMask,
        _GUID *ObjectTypeGuid,
        _GUID *InheritedObjectTypeGuid,
        PVOID Sid,
        UINT8 NewType){
  ACCESS_MASK v9; 
  int v10; 
  int v11; 
  INT64 result; 
  unsigned int v13; 
  int v14; 
  WORD v15; 
  __int64 v16; 
  PACE v17; 
  _GUID *p_AccessMask; 
  PACE Ace; 
  Ace = 0i64;
  v9 = AccessMask;
  v10 = AceFlags;
  v11 = AceRevision;
  if( !RtlValidSid(Sid) )
    return 3221225592i64;
  if( Acl->AclRevision > 4u || v11 != 4 )
    return 3221225561i64;
  v13 = v10 & 0xFFFFFFE0;
  if( (v10 & 0xFFFFFFE0) != 0 )
  {
    if( NewType == 7 )
      v13 = v10 & 0xFFFFFF20;
    if( v13 )
      return 3221225485i64;
  }
  if( !RtlValidAcl(Acl) || !RtlFirstFreeAce(Acl, (VOID **)&Ace) )
    return 3221225591i64;
  v14 = *((unsigned __int8 *)Sid + 1);
  v15 = 4 * v14 + 20;
  if( ObjectTypeGuid )
    v15 = 4 * v14 + 36;
  v16 = ObjectTypeGuid != 0i64;
  if( InheritedObjectTypeGuid )
  {
    LODWORD(v16) = v16 | 2;
    v15 += 16;
  }
  v17 = Ace;
  if( !Ace || (char *)Ace + v15 > (char *)Acl + Acl->AclSize )
    return 3221225625i64;
  Ace->Header.AceSize = v15;
  p_AccessMask = (_GUID *)&v17[1].AccessMask;
  v17->Header.AceFlags = v10;
  v17->Header.AceType = NewType;
  v17->AccessMask = v9;
  v17[1].Header = (ACE_HEADER)v16;
  if( ObjectTypeGuid )
  {
    *p_AccessMask = *ObjectTypeGuid;
    p_AccessMask = (_GUID *)&v17[3].AccessMask;
  }
  if( InheritedObjectTypeGuid )
    *p_AccessMask++ = *InheritedObjectTypeGuid;
  RtlCopySid(4 * v14 + 8, p_AccessMask, Sid);
  ++Acl->AceCount;
  result = 0i64;
  Acl->AclRevision = 4;
  return result;
}

Referenced by:

RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedObjectAce
RtlAddAuditAccessObjectAce