RtlpCopyEffectiveAce

UINT8 __stdcall RtlpCopyEffectiveAce(
        _ACE_HEADER *OldAce,
        UINT8 AutoInherit,
        UINT8 WillGenerateInheritAce,
        VOID *ClientOwnerSid,
        VOID *ClientGroupSid,
        VOID *ServerOwnerSid,
        VOID *ServerGroupSid,
        _GENERIC_MAPPING *GenericMapping,
        _GUID **pNewObjectType,
        UINT64 GuidCount,
        VOID **AcePosition,
        UINT64 *NewAceLength,
        _ACL *NewAcl,
        UINT8 *ObjectAceInherited,
        UINT8 *EffectiveAceMapped,
        UINT8 *AclOverflowed){
  UINT8 v17; 
  unsigned __int8 *v18; 
  unsigned __int8 *v19; 
  UCHAR AceType; 
  __int64 AceSize; 
  unsigned int v23; 
  int v24; 
  unsigned int GenericAll; 
  int v26; 
  _DWORD *v27; 
  _BYTE *v28; 
  const VOID *v29; 
  char *v30; 
  __int64 v31; 
  char *v32; 
  unsigned __int8 *v33; 
  unsigned __int8 *v34; 
  char *v35; 
  unsigned int v36; 
  int v37; 
  unsigned __int8 *v38; 
  int v39; 
  signed int v40; 
  int v41; 
  int v42; 
  int v43; 
  int v44; 
  int v45; 
  unsigned __int8 *v46; 
  int v47; 
  __int64 v48; 
  __int64 v49; 
  int v50; 
  int v51; 
  _ACE_HEADER *v52; 
  _GUID **v53; 
  __int64 v54; 
  __int64 v55; 
  size_t v56; 
  size_t v57; 
  char v58; 
  _ACE_HEADER v61; 
  int v62; 
  char AccessMask[12]; 
  size_t Size[2]; 
  VOID *v65; 
  VOID *Sid1; 
  VOID *Src; 
  signed int v68; 
  unsigned __int8 *v69; 
  unsigned __int8 *v70; 
  unsigned __int8 *v71; 
  unsigned __int8 *v72; 
  VOID *v73; 
  __int16 Sid2; 
  int v75; 
  __int16 v76; 
  int v77; 
  char v78[8]; 
  int v79; 

  v17 = AutoInherit;
  v18 = (unsigned __int8 *)ClientOwnerSid;
  v75 = 0;
  v76 = 768;
  v72 = (unsigned __int8 *)ClientOwnerSid;
  if( ServerOwnerSid )
    v18 = (unsigned __int8 *)ServerOwnerSid;
  v70 = v18;
  v19 = (unsigned __int8 *)ClientGroupSid;
  if( ServerGroupSid )
    v19 = (unsigned __int8 *)ServerGroupSid;
  v71 = (unsigned __int8 *)ClientGroupSid;
  v69 = v19;
  *(_QWORD *)&AccessMask[4] = EffectiveAceMapped;
  v58 = 0;
  Sid2 = 257;
  v77 = 0;
  *EffectiveAceMapped = 0;
  if( ObjectAceInherited )
    *ObjectAceInherited = 0;
  *AclOverflowed = 0;
  AceType = OldAce->AceType;
  AceSize = OldAce->AceSize;
  if( OldAce->AceType <= 0xAu || (unsigned __int8)(AceType - 13) <= 1u )
  {
    v65 = 0i64;
    v73 = 0i64;
    v68 = 0;
    if( AceType <= 3u )
    {
      Sid1 = &OldAce[2];
      *(_QWORD *)Size = 8i64;
LABEL_22:
      Src = OldAce;
      goto LABEL_23;
    }
    if( ((AceType - 9) & 0xFA) == 0 )
    {
      *(_QWORD *)Size = 8i64;
      Sid1 = &OldAce[2];
      v73 = &OldAce[2].AceType + (unsigned int)RtlLengthSid((INT64)&OldAce[2]);
      v68 = AceSize - RtlLengthSid((INT64)&OldAce[2]) - 8;
      goto LABEL_22;
    }
    if( AceType != 4 )
    {
      v48 = 7i64;
      v49 = 4i64 * (*(_DWORD *)&OldAce[2] & 1);
      v50 = *(_DWORD *)&OldAce[2] & 2;
      if( !v50 )
        v48 = 3i64;
      Sid1 = &OldAce[v49 + v48];
      v51 = v49 * 4 + v48 * 4;
      *(_QWORD *)Size = (unsigned int)(v49 * 4 + v48 * 4);
      if( v50 )
        v52 = &OldAce[v49 + 3];
      else
        v52 = 0i64;
      Src = OldAce;
      if( ObjectAceInherited )
      {
        Src = OldAce;
        if( v52 )
        {
          v53 = pNewObjectType;
          if( !pNewObjectType || (*(_DWORD *)AccessMask = 0, !(_DWORD)GuidCount) )
          {
LABEL_86:
            LODWORD(AceSize) = 0;
            goto LABEL_18;
          }
          while( 1 )
          {
            v54 = *(_QWORD *)&v52->AceType;
            Src = *v53;
            v55 = v54 - *(_QWORD *)Src;
            if( !v55 )
              v55 = *(_QWORD *)&v52[2].AceType - *((_QWORD *)Src + 1);
            if( !v55 )
              break;
            ++v53;
            if( ++*(_DWORD *)AccessMask >= (unsigned int)GuidCount )
              goto LABEL_86;
          }
          *ObjectAceInherited = 1;
          if( WillGenerateInheritAce )
          {
            v58 = 1;
            goto LABEL_22;
          }
          *EffectiveAceMapped = 1;
          if( (*(_DWORD *)&OldAce[2] & 1) != 0 )
          {
            LODWORD(AceSize) = AceSize - 16;
            *(_QWORD *)Size = (unsigned int)(v51 - 16);
            memmove(v78, OldAce, Size[0]);
            v79 &= ~2u;
          }
          else
          {
            LODWORD(AceSize) = AceSize - 20;
            *(_QWORD *)Size = (unsigned int)(v51 - 20);
            memmove(v78, OldAce, Size[0]);
            v78[0] = *((_BYTE *)&RtlBaseAceType + OldAce->AceType);
          }
          Src = v78;
        }
      }
LABEL_23:
      if( !(_DWORD)AceSize )
        goto LABEL_11;
      v61 = OldAce[1];
      *(_ACE_HEADER *)AccessMask = v61;
      RtlMapGenericMask((UINT64 *)AccessMask, GenericMapping);
      v23 = OldAce->AceType;
      if( (unsigned __int8)v23 <= 0xAu && (v24 = 1651, _bittest(&v24, v23)) )
        GenericAll = GenericMapping->GenericAll;
      else
        GenericAll = GenericMapping->GenericAll | 0x1000000;
      v26 = *(_DWORD *)AccessMask & GenericAll;
      if( v26 != v61 )
        **(_BYTE **)&AccessMask[4] = 1;
      v62 = v26 & 0x11FFFFF;
      if( (v26 & 0x11FFFFF) == 0 && !RtlEqualPrefixSid(Sid1, &Sid2) )
      {
        LODWORD(AceSize) = 0;
        goto LABEL_11;
      }
      v27 = Sid1;
      if( !RtlEqualPrefixSid(Sid1, &Sid2) )
        goto LABEL_31;
      v37 = v27[2];
      if( !v37 )
      {
        v38 = v72;
LABEL_43:
        Sid1 = v38;
        v39 = AceSize + 4 * v38[1];
        v28 = *(_BYTE **)&AccessMask[4];
        LODWORD(AceSize) = v39 - 4;
        **(_BYTE **)&AccessMask[4] = 1;
        goto LABEL_32;
      }
      v41 = v37 - 1;
      if( v41 )
      {
        v42 = v41 - 1;
        if( !v42 )
        {
          v38 = v70;
          goto LABEL_43;
        }
        if( v42 == 1 )
        {
          v38 = v69;
          goto LABEL_43;
        }
      }
      else
      {
        v38 = v71;
        if( v71 )
          goto LABEL_43;
      }
LABEL_31:
      v28 = *(_BYTE **)&AccessMask[4];
LABEL_32:
      if( v58 && *v28 )
      {
        if( (*(_DWORD *)&OldAce[2] & 1) != 0 )
        {
          LODWORD(AceSize) = AceSize - 16;
          v56 = Size[0] - 16;
          *(_QWORD *)Size = Size[0] - 16;
          memmove(v78, OldAce, v56);
          v79 &= ~2u;
          v29 = v78;
        }
        else
        {
          LODWORD(AceSize) = AceSize - 20;
          v57 = Size[0] - 20;
          *(_QWORD *)Size = Size[0] - 20;
          memmove(v78, OldAce, v57);
          v29 = v78;
          v78[0] = *((_BYTE *)&RtlBaseAceType + OldAce->AceType);
        }
      }
      else
      {
        v29 = Src;
      }
      v30 = (char *)*AcePosition;
      if( *AcePosition && (unsigned int)AceSize <= (__int64)NewAcl + NewAcl->AclSize - (_QWORD)v30 )
      {
        v31 = Size[0];
        memmove(*AcePosition, v29, Size[0]);
        v32 = &v30[v31];
        v33 = (unsigned __int8 *)v65;
        if( v65 )
        {
          memmove(v32, v65, 4 * *((unsigned __int8 *)v65 + 1) + 8);
          v32 += 4 * v33[1] + 8;
        }
        v34 = (unsigned __int8 *)Sid1;
        memmove(v32, Sid1, 4 * *((unsigned __int8 *)Sid1 + 1) + 8);
        v35 = &v32[4 * v34[1] + 8];
        if( v73 && v68 > 0 )
        {
          v40 = v68;
          memmove(v35, v73, v68);
          LODWORD(v35) = v40 + (_DWORD)v35;
        }
        v36 = (_DWORD)v35 - *(_DWORD *)AcePosition;
        if( (unsigned int)AceSize < v36 )
          return 0;
        LODWORD(AceSize) = v36;
        v17 = AutoInherit;
        *((_WORD *)*AcePosition + 1) = AceSize;
        *((_DWORD *)*AcePosition + 1) = v62;
        goto LABEL_11;
      }
LABEL_44:
      *AclOverflowed = 1;
      goto LABEL_16;
    }
    v65 = &OldAce[3];
    *(_QWORD *)Size = 12i64;
    Sid1 = &OldAce[3].AceType + (unsigned int)RtlLengthSid((INT64)&OldAce[3]);
    if( RtlEqualPrefixSid(&OldAce[3], &Sid2) )
    {
      v43 = *((_DWORD *)v65 + 2);
      if( !v43 )
      {
        v46 = v72;
        goto LABEL_66;
      }
      v44 = v43 - 1;
      if( v44 )
      {
        v45 = v44 - 1;
        if( !v45 )
        {
          v46 = v70;
          goto LABEL_66;
        }
        if( v45 == 1 )
        {
          v46 = v69;
LABEL_66:
          v65 = v46;
          LODWORD(AceSize) = AceSize + 4 * v46[1] - 4;
          **(_BYTE **)&AccessMask[4] = 1;
          goto LABEL_22;
        }
      }
      else
      {
        v46 = v71;
        if( v71 )
          goto LABEL_66;
      }
      if( **(_BYTE **)&AccessMask[4] )
        goto LABEL_22;
      v47 = *((unsigned __int8 *)v65 + 1);
    }
    else
    {
      v47 = *((unsigned __int8 *)v65 + 1);
    }
    v65 = 0i64;
    *(_QWORD *)Size = (unsigned int)(4 * v47 + 20);
    goto LABEL_22;
  }
  if( AceSize > (__int64)NewAcl + NewAcl->AclSize - (_QWORD)*AcePosition )
    goto LABEL_44;
  memmove(*AcePosition, OldAce, OldAce->AceSize);
LABEL_11:
  if( !*AclOverflowed && (_DWORD)AceSize )
  {
    *((_BYTE *)*AcePosition + 1) &= 0xE0u;
    if( v17 )
      *((_BYTE *)*AcePosition + 1) |= 0x10u;
    ++NewAcl->AceCount;
  }
LABEL_16:
  if( (unsigned int)AceSize <= 0xFFFF )
  {
    if( *AclOverflowed )
    {
LABEL_19:
      *(_DWORD *)NewAceLength = AceSize;
      return 1;
    }
LABEL_18:
    *AcePosition = (char *)*AcePosition + (unsigned int)AceSize;
    goto LABEL_19;
  }
  return 0;
}

Referenced by:

RtlpCopyAces
RtlpGenerateInheritedAce