RtlpCopyEffectiveAce
UINT8 __fastcall RtlpCopyEffectiveAce(
_ACE_HEADER *OldAce,
UINT8 AutoInherit,
UINT8 WillGenerateInheritAce,
VOID *ClientOwnerSid,
VOID *ClientGroupSid,
VOID *ServerOwnerSid,
VOID *ServerGroupSid,
_GENERIC_MAPPING *GenericMapping,
_GUID **pNewObjectType,
UINT64 GuidCount,
VOID **AcePosition,
UINT64 *NewAceLength,
_ACL *NewAcl,
UINT8 *ObjectAceInherited,
UINT8 *EffectiveAceMapped,
UINT8 *AclOverflowed){
UINT8 v17;
unsigned __int8 *v18;
unsigned __int8 *v19;
BYTE AceType;
__int64 AceSize;
unsigned int v23;
int v24;
unsigned int GenericAll;
DWORD v26;
_DWORD *v27;
UINT8 *v28;
UINT8 *v29;
char *v30;
__int64 v31;
UINT8 *v32;
UINT8 *v33;
unsigned __int8 *v34;
UINT8 *v35;
unsigned int v36;
int v37;
unsigned __int8 *v38;
int v39;
int v40;
int v41;
int v42;
int v43;
int v44;
int v45;
UINT8 *v46;
int v47;
__int64 v48;
__int64 v49;
int v50;
int v51;
_ACE_HEADER *v52;
void **v53;
__int64 v54;
__int64 v55;
unsigned int v56;
unsigned int v57;
char v58;
DWORD v61;
int v62;
DWORD AccessMask;
UINT8 *v64;
size_t Size;
UINT8 *p_AceType;
PSID Sid1;
void *Src;
int v69;
unsigned __int8 *v70;
unsigned __int8 *v71;
unsigned __int8 *v72;
unsigned __int8 *v73;
UINT8 *v74;
__int16 Sid2;
int v76;
__int16 v77;
int v78;
char dst[8];
int v80;
v17 = AutoInherit;
v18 = (unsigned __int8 *)ClientOwnerSid;
v76 = 0;
v77 = 768;
v73 = (unsigned __int8 *)ClientOwnerSid;
if( ServerOwnerSid )
v18 = (unsigned __int8 *)ServerOwnerSid;
v71 = v18;
v19 = (unsigned __int8 *)ClientGroupSid;
if( ServerGroupSid )
v19 = (unsigned __int8 *)ServerGroupSid;
v72 = (unsigned __int8 *)ClientGroupSid;
v70 = v19;
v64 = EffectiveAceMapped;
v58 = 0;
Sid2 = 257;
v78 = 0;
*EffectiveAceMapped = 0;
if( ObjectAceInherited )
*ObjectAceInherited = 0;
*AclOverflowed = 0;
AceType = OldAce->AceType;
AceSize = OldAce->AceSize;
if( OldAce->AceType <= 0xAu || (unsigned __int8)(AceType - 13) <= 1u )
{
p_AceType = 0i64;
v74 = 0i64;
v69 = 0;
if( AceType <= 3u )
{
Sid1 = &OldAce[2];
Size = 8i64;
LABEL_22:
Src = OldAce;
goto LABEL_23;
}
if( ((AceType - 9) & 0xFA) == 0 )
{
Size = 8i64;
Sid1 = &OldAce[2];
v74 = &OldAce[2].AceType + (unsigned int)RtlLengthSid(&OldAce[2]);
v69 = AceSize - RtlLengthSid(&OldAce[2]) - 8;
goto LABEL_22;
}
if( AceType != 4 )
{
v48 = 7i64;
v49 = 4i64 * (*(_DWORD *)&OldAce[2] & 1);
v50 = *(_DWORD *)&OldAce[2] & 2;
if( !v50 )
v48 = 3i64;
Sid1 = &OldAce[v49 + v48];
v51 = v49 * 4 + v48 * 4;
Size = (unsigned int)(v49 * 4 + v48 * 4);
if( v50 )
v52 = &OldAce[v49 + 3];
else
v52 = 0i64;
Src = OldAce;
if( ObjectAceInherited )
{
Src = OldAce;
if( v52 )
{
v53 = (void **)pNewObjectType;
if( !pNewObjectType || (AccessMask = 0, !(_DWORD)GuidCount) )
{
LABEL_86:
LODWORD(AceSize) = 0;
goto LABEL_18;
}
while( 1 )
{
v54 = *(_QWORD *)&v52->AceType;
Src = *v53;
v55 = v54 - *(_QWORD *)Src;
if( !v55 )
v55 = *(_QWORD *)&v52[2].AceType - *((_QWORD *)Src + 1);
if( !v55 )
break;
++v53;
if( ++AccessMask >= (unsigned int)GuidCount )
goto LABEL_86;
}
*ObjectAceInherited = 1;
if( WillGenerateInheritAce )
{
v58 = 1;
goto LABEL_22;
}
*EffectiveAceMapped = 1;
if( (*(_DWORD *)&OldAce[2] & 1) != 0 )
{
LODWORD(AceSize) = AceSize - 16;
Size = (unsigned int)(v51 - 16);
memmove((UINT8 *)dst, &OldAce->AceType, Size);
v80 &= ~2u;
}
else
{
LODWORD(AceSize) = AceSize - 20;
Size = (unsigned int)(v51 - 20);
memmove((UINT8 *)dst, &OldAce->AceType, Size);
dst[0] = *((_BYTE *)&RtlBaseAceType + OldAce->AceType);
}
Src = dst;
}
}
LABEL_23:
if( !(_DWORD)AceSize )
goto LABEL_11;
v61 = (DWORD)OldAce[1];
AccessMask = v61;
RtlMapGenericMask((UINT64 *)&AccessMask, GenericMapping);
v23 = OldAce->AceType;
if( (unsigned __int8)v23 <= 0xAu && (v24 = 1651, _bittest(&v24, v23)) )
GenericAll = GenericMapping->GenericAll;
else
GenericAll = GenericMapping->GenericAll | 0x1000000;
v26 = AccessMask & GenericAll;
if( v26 != v61 )
*v64 = 1;
v62 = v26 & 0x11FFFFF;
if( (v26 & 0x11FFFFF) == 0 && !RtlEqualPrefixSid(Sid1, &Sid2) )
{
LODWORD(AceSize) = 0;
goto LABEL_11;
}
v27 = Sid1;
if( !RtlEqualPrefixSid(Sid1, &Sid2) )
goto LABEL_31;
v37 = v27[2];
if( !v37 )
{
v38 = v73;
LABEL_43:
Sid1 = v38;
v39 = AceSize + 4 * v38[1];
v28 = v64;
LODWORD(AceSize) = v39 - 4;
*v64 = 1;
goto LABEL_32;
}
v41 = v37 - 1;
if( v41 )
{
v42 = v41 - 1;
if( !v42 )
{
v38 = v71;
goto LABEL_43;
}
if( v42 == 1 )
{
v38 = v70;
goto LABEL_43;
}
}
else
{
v38 = v72;
if( v72 )
goto LABEL_43;
}
LABEL_31:
v28 = v64;
LABEL_32:
if( v58 && *v28 )
{
if( (*(_DWORD *)&OldAce[2] & 1) != 0 )
{
v56 = Size - 16;
LODWORD(AceSize) = AceSize - 16;
Size = (unsigned int)(Size - 16);
memmove((UINT8 *)dst, &OldAce->AceType, v56);
v80 &= ~2u;
v29 = (UINT8 *)dst;
}
else
{
v57 = Size - 20;
LODWORD(AceSize) = AceSize - 20;
Size = (unsigned int)(Size - 20);
memmove((UINT8 *)dst, &OldAce->AceType, v57);
v29 = (UINT8 *)dst;
dst[0] = *((_BYTE *)&RtlBaseAceType + OldAce->AceType);
}
}
else
{
v29 = (UINT8 *)Src;
}
v30 = (char *)*AcePosition;
if( *AcePosition && (unsigned int)AceSize <= (__int64)NewAcl + NewAcl->AclSize - (_QWORD)v30 )
{
v31 = (unsigned int)Size;
memmove((UINT8 *)*AcePosition, v29, (unsigned int)Size);
v32 = (UINT8 *)&v30[v31];
v33 = p_AceType;
if( p_AceType )
{
memmove(v32, p_AceType, 4i64 * p_AceType[1] + 8);
v32 += 4 * v33[1] + 8;
}
v34 = (unsigned __int8 *)Sid1;
memmove(v32, (UINT8 *)Sid1, 4i64 * *((unsigned __int8 *)Sid1 + 1) + 8);
v35 = &v32[4 * v34[1] + 8];
if( v74 && v69 > 0 )
{
v40 = v69;
memmove(v35, v74, v69);
LODWORD(v35) = v40 + (_DWORD)v35;
}
v36 = (_DWORD)v35 - *(_DWORD *)AcePosition;
if( (unsigned int)AceSize < v36 )
return 0;
LODWORD(AceSize) = v36;
v17 = AutoInherit;
*((_WORD *)*AcePosition + 1) = AceSize;
*((_DWORD *)*AcePosition + 1) = v62;
goto LABEL_11;
}
LABEL_44:
*AclOverflowed = 1;
goto LABEL_16;
}
p_AceType = &OldAce[3].AceType;
Size = 12i64;
Sid1 = &OldAce[3].AceType + (unsigned int)RtlLengthSid(&OldAce[3]);
if( RtlEqualPrefixSid(&OldAce[3], &Sid2) )
{
v43 = *((_DWORD *)p_AceType + 2);
if( !v43 )
{
v46 = v73;
goto LABEL_66;
}
v44 = v43 - 1;
if( v44 )
{
v45 = v44 - 1;
if( !v45 )
{
v46 = v71;
goto LABEL_66;
}
if( v45 == 1 )
{
v46 = v70;
LABEL_66:
p_AceType = v46;
LODWORD(AceSize) = AceSize + 4 * v46[1] - 4;
*v64 = 1;
goto LABEL_22;
}
}
else
{
v46 = v72;
if( v72 )
goto LABEL_66;
}
if( *v64 )
goto LABEL_22;
v47 = p_AceType[1];
}
else
{
v47 = p_AceType[1];
}
p_AceType = 0i64;
Size = (unsigned int)(4 * v47 + 20);
goto LABEL_22;
}
if( AceSize > (__int64)NewAcl + NewAcl->AclSize - (_QWORD)*AcePosition )
goto LABEL_44;
memmove((UINT8 *)*AcePosition, &OldAce->AceType, OldAce->AceSize);
LABEL_11:
if( !*AclOverflowed && (_DWORD)AceSize )
{
*((_BYTE *)*AcePosition + 1) &= 0xE0u;
if( v17 )
*((_BYTE *)*AcePosition + 1) |= 0x10u;
++NewAcl->AceCount;
}
LABEL_16:
if( (unsigned int)AceSize <= 0xFFFF )
{
if( *AclOverflowed )
{
LABEL_19:
*(_DWORD *)NewAceLength = AceSize;
return 1;
}
LABEL_18:
*AcePosition = (char *)*AcePosition + (unsigned int)AceSize;
goto LABEL_19;
}
return 0;
}Referenced by:
RtlpCopyAces
RtlpGenerateInheritedAce