SeCaptureSecurityDescriptor

NTSTATUS __stdcall SeCaptureSecurityDescriptor(
        VOID *InputSecurityDescriptor,
        INT8 RequestorMode,
        POOL_TYPE PoolType,
        UINT8 ForceCapture,
        VOID **OutputSecurityDescriptor,
        INT64 a6,
        INT64 a7){
  unsigned int v8; 
  unsigned int v9; 
  unsigned __int64 v10; 
  unsigned __int64 v11; 
  char v12; 
  char *v13; 
  char *v14; 
  unsigned __int16 *v15; 
  unsigned __int16 *v16; 
  unsigned __int64 v17; 
  size_t v18; 
  size_t v19; 
  unsigned int v20; 
  unsigned int v21; 
  unsigned int v22; 
  __int16 v23; 
  unsigned __int64 v24; 
  __int64 v25; 
  unsigned __int64 v26; 
  unsigned int v27; 
  unsigned __int64 v28; 
  unsigned __int64 v29; 
  unsigned __int64 v30; 
  int v31; 
  UINT64 v32; 
  VOID **PoolWithTag; 
  VOID **v34; 
  _ACL *v35; 
  INT8 v36; 
  VOID *v37; 
  VOID *v38; 
  char v39; 
  int v40; 
  int v41; 
  unsigned __int64 v43; 
  __int64 v44; 
  VOID *v45; 
  VOID *v46; 
  char v47; 
  int v48; 
  int v49; 
  size_t Size; 
  unsigned int v51; 
  int v52; 
  int v53; 
  size_t v54; 
  size_t v55; 
  char v56; 
  VOID *v57; 
  VOID *v58; 
  __int128 v59; 
  char *v60; 
  unsigned __int16 *v61; 
  unsigned __int16 *Src; 
  unsigned int v63; 
  unsigned int v64; 
  unsigned int v65; 
  __int128 v66; 
  __int16 v67; 

  DWORD1(v59) = 0;
  v8 = 0;
  LOBYTE(v52) = 0;
  v56 = 0;
  Size = 0;
  v51 = 0;
  LOBYTE(v53) = 0;
  v49 = 0;
  if( !InputSecurityDescriptor )
  {
    *OutputSecurityDescriptor = 0i64;
    return 0;
  }
  if( RequestorMode )
  {
    if( ((unsigned __int8)InputSecurityDescriptor & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v66 = *(_OWORD *)InputSecurityDescriptor;
    v9 = *((_DWORD *)InputSecurityDescriptor + 4);
    v10 = *(_QWORD *)InputSecurityDescriptor;
    if( (WORD1(*(_OWORD *)InputSecurityDescriptor) & 0x8000u) == 0
      && ((unsigned __int8)InputSecurityDescriptor & 7) != 0 )
    {
      ExRaiseDatatypeMisalignment();
    }
    LOBYTE(v52) = 0;
    Size = 0;
    LOBYTE(v53) = 0;
    v49 = 0;
  }
  else
  {
    if( !ForceCapture )
    {
      *OutputSecurityDescriptor = InputSecurityDescriptor;
      return 0;
    }
    v66 = *(_OWORD *)InputSecurityDescriptor;
    v9 = *((_DWORD *)InputSecurityDescriptor + 4);
    v10 = *(_QWORD *)InputSecurityDescriptor;
  }
  if( (_BYTE)v66 != 1 )
    return -1073741736;
  LOBYTE(v59) = 1;
  BYTE1(v59) = BYTE1(v10);
  v11 = v10 >> 16;
  v12 = BYTE2(v10);
  WORD1(v59) = WORD1(v10) & 0x7FFF;
  if( (v10 & 0x80000000) != 0 )
  {
    v17 = HIDWORD(v10);
    if( (_DWORD)v17 )
      v13 = (char *)InputSecurityDescriptor + v17;
    else
      v13 = 0i64;
  }
  else
  {
    v13 = (char *)*((_QWORD *)InputSecurityDescriptor + 1);
  }
  v57 = v13;
  *((_QWORD *)&v59 + 1) = v13;
  if( (v11 & 0x8000u) == 0i64 )
  {
    v14 = (char *)*((_QWORD *)InputSecurityDescriptor + 2);
    goto LABEL_16;
  }
  if( DWORD2(v66) )
  {
    v14 = (char *)InputSecurityDescriptor + DWORD2(v66);
LABEL_16:
    v58 = v14;
    goto LABEL_17;
  }
  v14 = 0i64;
  v58 = 0i64;
LABEL_17:
  v60 = v14;
  if( (v11 & 0x10) != 0 )
  {
    if( (v11 & 0x8000u) == 0i64 )
    {
      v15 = (unsigned __int16 *)*((_QWORD *)InputSecurityDescriptor + 3);
    }
    else if( HIDWORD(v66) )
    {
      v15 = (unsigned __int16 *)((char *)InputSecurityDescriptor + HIDWORD(*((_QWORD *)&v66 + 1)));
    }
    else
    {
      v15 = 0i64;
    }
  }
  else
  {
    v15 = 0i64;
  }
  v61 = v15;
  if( (v11 & 4) != 0 )
  {
    if( (v11 & 0x8000u) == 0i64 )
    {
      v16 = (unsigned __int16 *)*((_QWORD *)InputSecurityDescriptor + 4);
    }
    else if( v9 )
    {
      v16 = (unsigned __int16 *)((char *)InputSecurityDescriptor + v9);
    }
    else
    {
      v16 = 0i64;
    }
  }
  else
  {
    v16 = 0i64;
  }
  Src = v16;
  v18 = 0;
  v54 = 0;
  v19 = 0;
  v55 = 0;
  v63 = 0;
  v20 = 0;
  v64 = 0;
  v21 = 0;
  v22 = 0;
  v65 = 0;
  v67 = v12 & 0x10;
  if( (v12 & 0x10) != 0 && v15 )
  {
    if( RequestorMode )
    {
      v43 = (unsigned __int64)(v15 + 1);
      if( v43 >= 0x7FFFFFFF0000i64 )
        v43 = 0x7FFFFFFF0000i64;
      v44 = *(unsigned __int16 *)v43;
      v18 = *(unsigned __int16 *)v43;
      v54 = v18;
      if( *(_WORD *)v43 )
      {
        if( ((unsigned __int8)v61 & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        v15 = v61;
        if( (unsigned __int64)v61 + v44 > 0x7FFFFFFF0000i64 || (unsigned __int16 *)((char *)v61 + v44) < v61 )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      else
      {
        v15 = v61;
      }
      v58 = v14;
      v57 = v13;
      v12 = BYTE2(v59);
      v19 = 0;
      LOBYTE(v52) = 0;
      Size = 0;
      LOBYTE(v53) = 0;
      v49 = 0;
    }
    else
    {
      v18 = v15[1];
      v54 = v18;
    }
    v8 = (v18 + 3) & 0xFFFFFFFC;
    v63 = v8;
    if( v8 - 8 > 0xFFF7 )
      return -1073741705;
  }
  else
  {
    v15 = 0i64;
    v61 = 0i64;
  }
  v23 = v12 & 4;
  if( v23 && v16 )
  {
    if( RequestorMode )
    {
      v24 = (unsigned __int64)(v16 + 1);
      if( v24 >= 0x7FFFFFFF0000i64 )
        v24 = 0x7FFFFFFF0000i64;
      v25 = *(unsigned __int16 *)v24;
      v19 = *(unsigned __int16 *)v24;
      v55 = v19;
      if( *(_WORD *)v24 )
      {
        if( ((unsigned __int8)Src & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        v16 = Src;
        if( (unsigned __int64)Src + v25 > 0x7FFFFFFF0000i64 || (unsigned __int16 *)((char *)Src + v25) < Src )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      else
      {
        v16 = Src;
      }
      v15 = v61;
      v58 = v14;
      v57 = v13;
      v18 = v54;
      LOBYTE(v52) = 0;
      Size = 0;
      LOBYTE(v53) = 0;
      v49 = 0;
    }
    else
    {
      v19 = v16[1];
      v55 = v19;
    }
    v20 = (v19 + 3) & 0xFFFFFFFC;
    v64 = v20;
    if( v20 - 8 > 0xFFF7 )
      return -1073741705;
  }
  else
  {
    v16 = 0i64;
    Src = 0i64;
  }
  if( v13 )
  {
    if( RequestorMode )
    {
      v26 = (unsigned __int64)(v13 + 1);
      if( v26 >= 0x7FFFFFFF0000i64 )
        v26 = 0x7FFFFFFF0000i64;
      v52 = *(unsigned __int8 *)v26;
      v56 = *(_BYTE *)v26;
      v27 = 4 * v52 + 8;
      Size = v27;
      v51 = v27;
      if( 4 * v52 == -8 )
      {
        v57 = (VOID *)*((_QWORD *)&v59 + 1);
      }
      else
      {
        if( (BYTE8(v59) & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        v57 = (VOID *)*((_QWORD *)&v59 + 1);
        v28 = *((_QWORD *)&v59 + 1) + v27;
        if( v28 > 0x7FFFFFFF0000i64 || v28 < *((_QWORD *)&v59 + 1) )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      v16 = Src;
      v15 = v61;
      v14 = v60;
      v58 = v60;
      v18 = v54;
      v19 = v55;
      LOBYTE(v53) = 0;
      v49 = 0;
    }
    else
    {
      v48 = (unsigned __int8)v13[1];
      LOBYTE(v52) = v48;
      v56 = v48;
      v27 = 4 * v48 + 8;
      v51 = v27;
      Size = v27;
    }
    v22 = (v27 + 3) & 0xFFFFFFFC;
    v65 = v22;
  }
  if( v14 )
  {
    if( RequestorMode )
    {
      v29 = (unsigned __int64)(v14 + 1);
      if( v29 >= 0x7FFFFFFF0000i64 )
        v29 = 0x7FFFFFFF0000i64;
      v53 = *(unsigned __int8 *)v29;
      v49 = 4 * v53 + 8;
      if( 4 * v53 == -8 )
      {
        v58 = v60;
      }
      else
      {
        if( ((unsigned __int8)v60 & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        v58 = v60;
        v30 = (unsigned __int64)&v60[4 * v53 + 8];
        if( v30 > 0x7FFFFFFF0000i64 || v30 < (unsigned __int64)v60 )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      v16 = Src;
      v15 = v61;
      v57 = (VOID *)*((_QWORD *)&v59 + 1);
      v18 = v54;
      v19 = v55;
      LOBYTE(v52) = v56;
      Size = v51;
      v31 = 4 * v53 + 8;
    }
    else
    {
      LOBYTE(v53) = v14[1];
      v31 = 4 * (unsigned __int8)v53 + 8;
      v49 = v31;
    }
    v21 = (v31 + 3) & 0xFFFFFFFC;
  }
  v32 = v8 + 20 + v20 + v21 + v22;
  PoolWithTag = ExAllocatePoolWithTag((unsigned int)PoolType, v32, 1666409811i64);
  v34 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memset(PoolWithTag, 0i64, v32);
  *(_OWORD *)v34 = v59;
  *((_DWORD *)v34 + 4) = (_DWORD)v60;
  v35 = (_ACL *)((char *)v34 + 20);
  *((_WORD *)v34 + 1) |= 0x8000u;
  if( !v67 || !v15 )
  {
    *((_DWORD *)v34 + 3) = 0;
    v36 = RequestorMode;
    goto LABEL_80;
  }
  memmove((char *)v34 + 20, v15, v18);
  v36 = RequestorMode;
  if( !RequestorMode
    || v18 >= 8 && v18 == *((unsigned __int16 *)v34 + 11) && (RtlValidAcl((_ACL *)((char *)v34 + 20), v45, v46), v47) )
  {
    *((_DWORD *)v34 + 3) = 20;
    *((_WORD *)v34 + 11) = v63;
    v35 = (_ACL *)((char *)v35 + v63);
LABEL_80:
    if( !v23 || !v16 )
    {
      *((_DWORD *)v34 + 4) = 0;
LABEL_87:
      if( v57 )
      {
        memmove(v35, v57, Size);
        v35->Sbz1 = v52;
        if( v36
          && ((unsigned __int64)v35 <= 0x7FFFFFFF0000i64 || (unsigned __int8)v52 > 0xFu || (v35->AclRevision & 0xF) != 1) )
        {
          goto LABEL_131;
        }
        v40 = (_DWORD)v35 - (_DWORD)v34;
        v35 = (_ACL *)((char *)v35 + v65);
      }
      else
      {
        v40 = 0;
      }
      *((_DWORD *)v34 + 1) = v40;
      if( !v58 )
      {
        v41 = 0;
        goto LABEL_99;
      }
      memmove(v35, v58, v49);
      v35->Sbz1 = v53;
      if( !v36
        || (unsigned __int64)v35 > 0x7FFFFFFF0000i64 && (unsigned __int8)v53 <= 0xFu && (v35->AclRevision & 0xF) == 1 )
      {
        v41 = (_DWORD)v35 - (_DWORD)v34;
LABEL_99:
        *((_DWORD *)v34 + 2) = v41;
        *OutputSecurityDescriptor = v34;
        return 0;
      }
LABEL_131:
      ExFreePoolWithTag(v34, 0);
      return -1073741704;
    }
    memmove(v35, v16, v19);
    if( !v36 || v19 >= 8 && v19 == v35->AclSize && (RtlValidAcl(v35, v37, v38), v39) )
    {
      *((_DWORD *)v34 + 4) = (_DWORD)v35 - (_DWORD)v34;
      v35->AclSize = v64;
      v35 = (_ACL *)((char *)v35 + v64);
      goto LABEL_87;
    }
  }
  ExFreePoolWithTag(v34, 0);
  return -1073741705;
}

Referenced by: