RtlNormalizeSecurityDescriptor
INT8 __fastcall RtlNormalizeSecurityDescriptor(INT64 *a1, UINT64 a2, INT64 *a3, UINT64 *a4, INT8 CheckOnly){
_DWORD *v5;
UINT64 v6;
_DWORD *PoolWithTag;
INT8 v9;
INT8 valid;
unsigned int v11;
unsigned int v12;
unsigned int v13;
unsigned int v14;
__int64 v15;
unsigned int v16;
unsigned __int16 v17;
__int64 v18;
unsigned int v19;
unsigned int v20;
_WORD *v21;
_WORD *v22;
unsigned __int16 v23;
_SIZE_T *v24;
int v25;
unsigned int v26;
unsigned int v27;
char *v28;
_WORD *v29;
unsigned __int16 v30;
_SIZE_T *v31;
INT8 IsZeroMemory;
unsigned int v33;
unsigned __int8 *v34;
NTSTATUS v35;
NTSTATUS v36;
unsigned int v37;
unsigned __int8 *v38;
NTSTATUS v39;
NTSTATUS v40;
INT64 *v41;
unsigned int v43;
unsigned int v44;
unsigned __int16 j;
unsigned int v46;
unsigned int v47;
unsigned __int16 i;
unsigned int v49;
int v50;
char *v51;
char v53;
v5 = (_DWORD *)*a1;
v6 = (unsigned int)a2;
v51 = 0i64;
v53 = 0;
PoolWithTag = 0i64;
v9 = 0;
valid = SeValidSecurityDescriptor((unsigned int)a2, *a1);
v11 = 0;
if( valid )
{
if( CheckOnly )
{
LABEL_8:
v12 = 20;
v13 = 1;
v50 = 1;
do
{
if( v13 == 1 )
v14 = v5[3];
else
v14 = v5[4];
v49 = v14;
if( v14 )
{
v15 = v14;
if( v13 != 1 || (v16 = 0, *(_WORD *)((char *)v5 + v14 + 4)) )
v16 = v12;
if( v16 != v14 )
{
v9 = 1;
if( CheckOnly )
goto LABEL_89;
if( v13 == 1 )
PoolWithTag[3] = v16;
else
PoolWithTag[4] = v16;
}
if( v16 )
{
if( !CheckOnly )
{
v51 = (char *)PoolWithTag + v16;
*(_QWORD *)v51 = *(_QWORD *)((char *)v5 + v14);
v11 = 0;
}
v17 = *(_WORD *)((char *)v5 + v14 + 4);
v18 = (__int64)v5 + v14 + 8;
v43 = 0;
v12 += 8;
v44 = 0;
v19 = 0;
v20 = 0;
v21 = (_WORD *)v18;
if( v17 )
{
while( 1 )
{
if( *(_BYTE *)v21 )
goto LABEL_37;
if( CheckOnly )
break;
v29 = v51 + 8;
v46 = 0;
if( !v19 )
goto LABEL_38;
v30 = v21[1];
for( i = v30; ; v30 = i )
{
if( v29[1] == v30 )
{
i = v21[1];
v31 = RtlCompareMemory(v21, v29, v30);
v19 = v43;
v11 = v46;
if( v31 == (_SIZE_T *)i )
break;
}
++v11;
v29 = (_WORD *)((char *)v29 + (unsigned __int16)v29[1]);
v46 = v11;
if( v11 >= v19 )
goto LABEL_37;
}
v9 = 1;
if( v46 >= v43 )
goto LABEL_37;
LOWORD(v25) = v21[1];
LABEL_40:
v14 = v49;
v15 = v49;
v20 = v44 + 1;
v21 = (_WORD *)((char *)v21 + (unsigned __int16)v25);
v44 = v20;
v17 = *(_WORD *)((char *)v5 + v49 + 4);
v18 = (__int64)v5 + v49 + 8;
if( v20 >= v17 )
{
v13 = v50;
goto LABEL_42;
}
v11 = 0;
}
v22 = (_WORD *)v18;
v47 = 0;
if( v20 )
{
v23 = v21[1];
for( j = v23; ; v23 = j )
{
if( v22[1] == v23 )
{
j = v21[1];
v24 = RtlCompareMemory(v21, v22, v23);
v20 = v44;
v11 = v47;
if( v24 == (_SIZE_T *)j )
break;
}
++v11;
v22 = (_WORD *)((char *)v22 + (unsigned __int16)v22[1]);
v47 = v11;
if( v11 >= v20 )
goto LABEL_36;
}
v9 = 1;
if( v47 < v44 )
goto LABEL_80;
LABEL_36:
v19 = v43;
}
LABEL_37:
if( !CheckOnly )
{
LABEL_38:
memmove((char *)PoolWithTag + v12, v21, (unsigned __int16)v21[1]);
v19 = v43;
}
v25 = (unsigned __int16)v21[1];
v12 += v25;
v43 = ++v19;
goto LABEL_40;
}
LABEL_42:
v26 = (v12 + 3) & 0xFFFFFFFC;
v27 = v26 - v16;
if( v26 - v16 == *(unsigned __int16 *)((char *)v5 + v15 + 2) )
{
v28 = v51;
}
else
{
v9 = 1;
if( CheckOnly )
goto LABEL_89;
v28 = v51;
*((_WORD *)v51 + 1) = v27;
v17 = *(_WORD *)((char *)v5 + v15 + 4);
}
if( v19 != v17 )
*((_WORD *)v28 + 2) = v19;
if( v12 == v26 )
{
v11 = 0;
}
else
{
if( v16 == v14 && v27 == *(unsigned __int16 *)((char *)v5 + v15 + 2) )
{
IsZeroMemory = RtlIsZeroMemory((_BYTE *)v5 + v12, v26 - v12);
v11 = 0;
if( !IsZeroMemory )
{
v9 = 1;
if( CheckOnly )
goto LABEL_89;
}
}
else
{
v11 = 0;
}
if( !CheckOnly )
{
memset((char *)PoolWithTag + v12, 0i64, v26 - v12);
v11 = 0;
}
v12 = (v12 + 3) & 0xFFFFFFFC;
}
}
}
v50 = ++v13;
}
while( v13 <= 2 );
v33 = v5[1];
if( v12 != v33 )
{
v9 = 1;
if( CheckOnly )
goto LABEL_89;
PoolWithTag[1] = v12;
v33 = v5[1];
}
v34 = (unsigned __int8 *)v5 + v33;
v35 = RtlLengthRequiredSid(v34[1]);
v36 = v35;
if( !CheckOnly )
memmove((char *)PoolWithTag + (unsigned int)PoolWithTag[1], v34, v35);
v37 = v5[2];
v12 += v36;
if( v37 )
{
if( v12 != v37 )
{
v9 = 1;
if( CheckOnly )
goto LABEL_89;
PoolWithTag[2] = v12;
v37 = v5[2];
}
v38 = (unsigned __int8 *)v5 + v37;
v39 = RtlLengthRequiredSid(v38[1]);
v40 = v39;
if( !CheckOnly )
memmove((char *)PoolWithTag + (unsigned int)PoolWithTag[2], v38, v39);
v12 += v40;
}
LABEL_80:
if( v9 && !CheckOnly )
{
v41 = a3;
if( a3 )
{
if( !v53 )
goto LABEL_87;
}
else
{
ExFreePoolWithTag(v5, 0);
v41 = a1;
}
*v41 = (INT64)PoolWithTag;
LABEL_87:
if( a4 )
*(_DWORD *)a4 = v12;
return v9;
}
LABEL_89:
if( v53 )
ExFreePoolWithTag(PoolWithTag, 0);
return v9;
}
if( a3 )
{
PoolWithTag = (_DWORD *)*a3;
if( *a3 )
{
LABEL_7:
*(_OWORD *)PoolWithTag = *(_OWORD *)v5;
PoolWithTag[4] = v5[4];
v11 = 0;
goto LABEL_8;
}
}
PoolWithTag = ExAllocatePoolWithTag(1ui64, v6, 1683187027i64);
if( PoolWithTag )
{
v53 = 1;
goto LABEL_7;
}
}
return 0;
}Referenced by:
No references.