SepAppendAceToTokenDefaultDacl

INT64 __fastcall SepAppendAceToTokenDefaultDacl(INT64 a1, UINT8 *a2){
  ACL *v2; 
  _ACL *v3; 
  __int64 v6; 
  int AclSize; 
  int Acl; 
  unsigned int v9; 
  struct _ACL *PoolWithTag; 
  UINT32 v11; 
  UINT64 AceListLength; 
  UINT32 Information; 
  PVOID Ace; 
  __int64 AclInformation; 
  int v17; 
  v2 = *(ACL **)(a1 + 184);
  Information = 0;
  v3 = 0i64;
  Ace = 0i64;
  AclInformation = 0i64;
  v17 = 0;
  if( !v2 )
  {
    Acl = 0;
LABEL_12:
    if( v3 )
      ExFreePoolWithTag(v3, 0);
    return(unsigned int)Acl;
  }
  LODWORD(v6) = RtlFindAceBySid(v2, a2, 0i64);
  if( v6 )
    return 0;
  AclSize = v2->AclSize;
  Acl = RtlQueryInformationAcl(v2, &Information, 4ui64, AclRevisionInformation);
  if( Acl >= 0 )
  {
    Acl = RtlQueryInformationAcl(v2, &AclInformation, 0xCui64, AclSizeInformation);
    if( Acl >= 0 )
    {
      v9 = (AclSize + 4 * a2[1] + 19) & 0xFFFFFFFC;
      PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v9, 0x63416553ui64);
      v3 = PoolWithTag;
      if( !PoolWithTag )
        return(unsigned int)-1073741670;
      v11 = Information;
      Acl = RtlCreateAcl(PoolWithTag, v9, Information);
      if( Acl >= 0 )
      {
        Acl = RtlGetAce(v2, 0i64, &Ace);
        if( Acl >= 0 )
        {
          LODWORD(AceListLength) = HIDWORD(AclInformation) - 8;
          Acl = RtlAddAce(v3, v11, 0i64, Ace, AceListLength);
          if( Acl >= 0 )
          {
            Acl = RtlAddAccessAllowedAce(v3, v11, 0x10000000u, a2);
            if( Acl >= 0 )
            {
              Acl = SepExpandDynamic(
                      (_TOKEN *)a1,
                      (v9 + 4 * *(unsigned __int8 *)(*(_QWORD *)(a1 + 168) + 1i64) + 11) & 0xFFFFFFFC);
              if( Acl >= 0 )
              {
                SepFreeDefaultDacl(a1);
                SepAppendDefaultDacl((_TOKEN *)a1, v3);
              }
            }
          }
        }
      }
      goto LABEL_12;
    }
  }
  return(unsigned int)Acl;
}

Referenced by: