RtlpCopyEffectiveAce
UINT8 __stdcall RtlpCopyEffectiveAce(
_ACE_HEADER *OldAce,
UINT8 AutoInherit,
UINT8 WillGenerateInheritAce,
VOID *ClientOwnerSid,
VOID *ClientGroupSid,
VOID *ServerOwnerSid,
VOID *ServerGroupSid,
_GENERIC_MAPPING *GenericMapping,
_GUID **pNewObjectType,
UINT64 GuidCount,
VOID **AcePosition,
UINT64 *NewAceLength,
_ACL *NewAcl,
UINT8 *ObjectAceInherited,
UINT8 *EffectiveAceMapped,
UINT8 *AclOverflowed){
UINT8 v17;
unsigned __int8 *v18;
unsigned __int8 *v19;
UCHAR AceType;
__int64 AceSize;
unsigned int v23;
int v24;
unsigned int GenericAll;
int v26;
_DWORD *v27;
_BYTE *v28;
const VOID *v29;
char *v30;
__int64 v31;
char *v32;
unsigned __int8 *v33;
unsigned __int8 *v34;
char *v35;
unsigned int v36;
int v37;
unsigned __int8 *v38;
int v39;
signed int v40;
int v41;
int v42;
int v43;
int v44;
int v45;
unsigned __int8 *v46;
int v47;
__int64 v48;
__int64 v49;
int v50;
int v51;
_ACE_HEADER *v52;
_GUID **v53;
__int64 v54;
__int64 v55;
size_t v56;
size_t v57;
char v58;
_ACE_HEADER v61;
int v62;
char AccessMask[12];
size_t Size[2];
VOID *v65;
VOID *Sid1;
VOID *Src;
signed int v68;
unsigned __int8 *v69;
unsigned __int8 *v70;
unsigned __int8 *v71;
unsigned __int8 *v72;
VOID *v73;
__int16 Sid2;
int v75;
__int16 v76;
int v77;
char v78[8];
int v79;
v17 = AutoInherit;
v18 = (unsigned __int8 *)ClientOwnerSid;
v75 = 0;
v76 = 768;
v72 = (unsigned __int8 *)ClientOwnerSid;
if( ServerOwnerSid )
v18 = (unsigned __int8 *)ServerOwnerSid;
v70 = v18;
v19 = (unsigned __int8 *)ClientGroupSid;
if( ServerGroupSid )
v19 = (unsigned __int8 *)ServerGroupSid;
v71 = (unsigned __int8 *)ClientGroupSid;
v69 = v19;
*(_QWORD *)&AccessMask[4] = EffectiveAceMapped;
v58 = 0;
Sid2 = 257;
v77 = 0;
*EffectiveAceMapped = 0;
if( ObjectAceInherited )
*ObjectAceInherited = 0;
*AclOverflowed = 0;
AceType = OldAce->AceType;
AceSize = OldAce->AceSize;
if( OldAce->AceType <= 0xAu || (unsigned __int8)(AceType - 13) <= 1u )
{
v65 = 0i64;
v73 = 0i64;
v68 = 0;
if( AceType <= 3u )
{
Sid1 = &OldAce[2];
*(_QWORD *)Size = 8i64;
LABEL_22:
Src = OldAce;
goto LABEL_23;
}
if( ((AceType - 9) & 0xFA) == 0 )
{
*(_QWORD *)Size = 8i64;
Sid1 = &OldAce[2];
v73 = &OldAce[2].AceType + (unsigned int)RtlLengthSid((INT64)&OldAce[2]);
v68 = AceSize - RtlLengthSid((INT64)&OldAce[2]) - 8;
goto LABEL_22;
}
if( AceType != 4 )
{
v48 = 7i64;
v49 = 4i64 * (*(_DWORD *)&OldAce[2] & 1);
v50 = *(_DWORD *)&OldAce[2] & 2;
if( !v50 )
v48 = 3i64;
Sid1 = &OldAce[v49 + v48];
v51 = v49 * 4 + v48 * 4;
*(_QWORD *)Size = (unsigned int)(v49 * 4 + v48 * 4);
if( v50 )
v52 = &OldAce[v49 + 3];
else
v52 = 0i64;
Src = OldAce;
if( ObjectAceInherited )
{
Src = OldAce;
if( v52 )
{
v53 = pNewObjectType;
if( !pNewObjectType || (*(_DWORD *)AccessMask = 0, !(_DWORD)GuidCount) )
{
LABEL_86:
LODWORD(AceSize) = 0;
goto LABEL_18;
}
while( 1 )
{
v54 = *(_QWORD *)&v52->AceType;
Src = *v53;
v55 = v54 - *(_QWORD *)Src;
if( !v55 )
v55 = *(_QWORD *)&v52[2].AceType - *((_QWORD *)Src + 1);
if( !v55 )
break;
++v53;
if( ++*(_DWORD *)AccessMask >= (unsigned int)GuidCount )
goto LABEL_86;
}
*ObjectAceInherited = 1;
if( WillGenerateInheritAce )
{
v58 = 1;
goto LABEL_22;
}
*EffectiveAceMapped = 1;
if( (*(_DWORD *)&OldAce[2] & 1) != 0 )
{
LODWORD(AceSize) = AceSize - 16;
*(_QWORD *)Size = (unsigned int)(v51 - 16);
memmove(v78, OldAce, Size[0]);
v79 &= ~2u;
}
else
{
LODWORD(AceSize) = AceSize - 20;
*(_QWORD *)Size = (unsigned int)(v51 - 20);
memmove(v78, OldAce, Size[0]);
v78[0] = *((_BYTE *)&RtlBaseAceType + OldAce->AceType);
}
Src = v78;
}
}
LABEL_23:
if( !(_DWORD)AceSize )
goto LABEL_11;
v61 = OldAce[1];
*(_ACE_HEADER *)AccessMask = v61;
RtlMapGenericMask((UINT64 *)AccessMask, GenericMapping);
v23 = OldAce->AceType;
if( (unsigned __int8)v23 <= 0xAu && (v24 = 1651, _bittest(&v24, v23)) )
GenericAll = GenericMapping->GenericAll;
else
GenericAll = GenericMapping->GenericAll | 0x1000000;
v26 = *(_DWORD *)AccessMask & GenericAll;
if( v26 != v61 )
**(_BYTE **)&AccessMask[4] = 1;
v62 = v26 & 0x11FFFFF;
if( (v26 & 0x11FFFFF) == 0 && !RtlEqualPrefixSid(Sid1, &Sid2) )
{
LODWORD(AceSize) = 0;
goto LABEL_11;
}
v27 = Sid1;
if( !RtlEqualPrefixSid(Sid1, &Sid2) )
goto LABEL_31;
v37 = v27[2];
if( !v37 )
{
v38 = v72;
LABEL_43:
Sid1 = v38;
v39 = AceSize + 4 * v38[1];
v28 = *(_BYTE **)&AccessMask[4];
LODWORD(AceSize) = v39 - 4;
**(_BYTE **)&AccessMask[4] = 1;
goto LABEL_32;
}
v41 = v37 - 1;
if( v41 )
{
v42 = v41 - 1;
if( !v42 )
{
v38 = v70;
goto LABEL_43;
}
if( v42 == 1 )
{
v38 = v69;
goto LABEL_43;
}
}
else
{
v38 = v71;
if( v71 )
goto LABEL_43;
}
LABEL_31:
v28 = *(_BYTE **)&AccessMask[4];
LABEL_32:
if( v58 && *v28 )
{
if( (*(_DWORD *)&OldAce[2] & 1) != 0 )
{
LODWORD(AceSize) = AceSize - 16;
v56 = Size[0] - 16;
*(_QWORD *)Size = Size[0] - 16;
memmove(v78, OldAce, v56);
v79 &= ~2u;
v29 = v78;
}
else
{
LODWORD(AceSize) = AceSize - 20;
v57 = Size[0] - 20;
*(_QWORD *)Size = Size[0] - 20;
memmove(v78, OldAce, v57);
v29 = v78;
v78[0] = *((_BYTE *)&RtlBaseAceType + OldAce->AceType);
}
}
else
{
v29 = Src;
}
v30 = (char *)*AcePosition;
if( *AcePosition && (unsigned int)AceSize <= (__int64)NewAcl + NewAcl->AclSize - (_QWORD)v30 )
{
v31 = Size[0];
memmove(*AcePosition, v29, Size[0]);
v32 = &v30[v31];
v33 = (unsigned __int8 *)v65;
if( v65 )
{
memmove(v32, v65, 4 * *((unsigned __int8 *)v65 + 1) + 8);
v32 += 4 * v33[1] + 8;
}
v34 = (unsigned __int8 *)Sid1;
memmove(v32, Sid1, 4 * *((unsigned __int8 *)Sid1 + 1) + 8);
v35 = &v32[4 * v34[1] + 8];
if( v73 && v68 > 0 )
{
v40 = v68;
memmove(v35, v73, v68);
LODWORD(v35) = v40 + (_DWORD)v35;
}
v36 = (_DWORD)v35 - *(_DWORD *)AcePosition;
if( (unsigned int)AceSize < v36 )
return 0;
LODWORD(AceSize) = v36;
v17 = AutoInherit;
*((_WORD *)*AcePosition + 1) = AceSize;
*((_DWORD *)*AcePosition + 1) = v62;
goto LABEL_11;
}
LABEL_44:
*AclOverflowed = 1;
goto LABEL_16;
}
v65 = &OldAce[3];
*(_QWORD *)Size = 12i64;
Sid1 = &OldAce[3].AceType + (unsigned int)RtlLengthSid((INT64)&OldAce[3]);
if( RtlEqualPrefixSid(&OldAce[3], &Sid2) )
{
v43 = *((_DWORD *)v65 + 2);
if( !v43 )
{
v46 = v72;
goto LABEL_66;
}
v44 = v43 - 1;
if( v44 )
{
v45 = v44 - 1;
if( !v45 )
{
v46 = v70;
goto LABEL_66;
}
if( v45 == 1 )
{
v46 = v69;
LABEL_66:
v65 = v46;
LODWORD(AceSize) = AceSize + 4 * v46[1] - 4;
**(_BYTE **)&AccessMask[4] = 1;
goto LABEL_22;
}
}
else
{
v46 = v71;
if( v71 )
goto LABEL_66;
}
if( **(_BYTE **)&AccessMask[4] )
goto LABEL_22;
v47 = *((unsigned __int8 *)v65 + 1);
}
else
{
v47 = *((unsigned __int8 *)v65 + 1);
}
v65 = 0i64;
*(_QWORD *)Size = (unsigned int)(4 * v47 + 20);
goto LABEL_22;
}
if( AceSize > (__int64)NewAcl + NewAcl->AclSize - (_QWORD)*AcePosition )
goto LABEL_44;
memmove(*AcePosition, OldAce, OldAce->AceSize);
LABEL_11:
if( !*AclOverflowed && (_DWORD)AceSize )
{
*((_BYTE *)*AcePosition + 1) &= 0xE0u;
if( v17 )
*((_BYTE *)*AcePosition + 1) |= 0x10u;
++NewAcl->AceCount;
}
LABEL_16:
if( (unsigned int)AceSize <= 0xFFFF )
{
if( *AclOverflowed )
{
LABEL_19:
*(_DWORD *)NewAceLength = AceSize;
return 1;
}
LABEL_18:
*AcePosition = (char *)*AcePosition + (unsigned int)AceSize;
goto LABEL_19;
}
return 0;
}Referenced by:
RtlpCopyAces
RtlpGenerateInheritedAce