RtlAddAccessFilterAce

NTSTATUS __stdcall RtlAddAccessFilterAce(
        PACL Acl,
        UINT64 a2,
        INT64 a3,
        INT64 a4,
        CHAR a5,
        INT64 a6,
        VOID *Src,
        INT16 a8){
  int v9; 
  unsigned int v10; 
  char v12; 
  NTSTATUS result; 
  int v14; 
  unsigned int AclRevision; 
  unsigned __int8 v16; 
  unsigned int v17; 
  unsigned int v18; 
  _BYTE *v19; 
  char *v20; 
  char v21; 
  VOID *FirstFree; 
  int v23; 
  unsigned __int16 v24; 

  v21 = a3;
  FirstFree = 0i64;
  v9 = a3;
  v23 = 0;
  v10 = a2;
  v24 = 256;
  if( !Acl )
    return -1073741705;
  RtlValidAcl(Acl, (VOID *)a2, (VOID *)a3);
  if( !v12 )
    return -1073741705;
  if( !Src || (unsigned __int16)(a8 - 6) > 0xFFF8u || *(_DWORD *)Src != 2020897377 || a5 != 21 )
    return -1073741811;
  if( !RtlValidSid((_BYTE *)a4) )
    return -1073741704;
  if( (v9 & 0x40) != 0 )
  {
    if( !RtlIsValidProcessTrustLabelSid((VOID *)a4) )
      return -1073741811;
  }
  else
  {
    v14 = *(_DWORD *)(a4 + 2) - v23;
    if( !v14 )
      v14 = *(unsigned __int16 *)(a4 + 6) - v24;
    if( v14 || *(_BYTE *)(a4 + 1) != 1 || *(_DWORD *)(a4 + 8) )
      return -1073741811;
  }
  AclRevision = Acl->AclRevision;
  if( (unsigned __int8)AclRevision > 4u || v10 > 4 )
    return -1073741735;
  v16 = Acl->AclRevision;
  if( AclRevision <= v10 )
    v16 = v10;
  if( (v9 & 0xFFFFFFA0) != 0 || (a6 & 0xFF000000) != 0 )
    return -1073741811;
  if( !RtlFirstFreeAce(Acl, &FirstFree) )
    return -1073741705;
  v17 = ((unsigned __int16)a8 + 3) & 0xFFFFFFFC;
  v18 = v17 + 4 * (*(unsigned __int8 *)(a4 + 1) + 4);
  if( v18 < v17 )
    return -1073741675;
  if( v18 > 0xFFFF )
    return -1073741811;
  v19 = FirstFree;
  if( !FirstFree || (char *)FirstFree + v18 > (char *)Acl + Acl->AclSize )
    return -1073741671;
  v20 = (char *)FirstFree + 8;
  *((_WORD *)FirstFree + 1) = v18;
  v19[1] = v21;
  *v19 = 21;
  *((_DWORD *)v19 + 1) = a6;
  RtlCopySid(4 * (unsigned int)*(unsigned __int8 *)(a4 + 1) + 8, v20, (VOID *)a4);
  memmove(&v19[4 * *(unsigned __int8 *)(a4 + 1) + 16], Src, (unsigned __int16)a8);
  ++Acl->AceCount;
  result = 0;
  Acl->AclRevision = v16;
  return result;
}

Referenced by: