RtlAddAce
NTSTATUS __stdcall RtlAddAce(
PACL Acl,
UINT64 AceRevision,
UINT64 StartingAceIndex,
VOID *AceList,
UINT64 AceListLength){
unsigned int v6;
unsigned int v7;
char v9;
char *v10;
unsigned __int8 AclRevision;
__int64 v12;
char *v13;
__int16 v14;
unsigned __int8 v15;
unsigned int v16;
PACL i;
int v18;
__int64 v19;
char *v20;
NTSTATUS result;
__int64 v22;
bool v23;
VOID *FirstFree;
FirstFree = 0i64;
v6 = StartingAceIndex;
v7 = AceRevision;
RtlValidAcl(Acl, (VOID *)AceRevision, (VOID *)StartingAceIndex);
if( !v9 || !RtlFirstFreeAce(Acl, &FirstFree) )
return -1073741811;
v10 = (char *)AceList;
AclRevision = v7;
v12 = (unsigned int)AceListLength;
if( (unsigned __int8)v7 <= Acl->AclRevision )
AclRevision = Acl->AclRevision;
v13 = (char *)AceList + (unsigned int)AceListLength;
v14 = 0;
if( AceList < v13 )
{
do
{
v15 = *v10;
if( (unsigned __int8)*v10 > 3u )
{
if( v15 > 4u )
{
if( v15 > 8u )
goto LABEL_7;
v23 = v7 < 4;
}
else
{
v23 = v7 < 3;
}
if( v23 )
return -1073741811;
}
LABEL_7:
++v14;
v10 += *((unsigned __int16 *)v10 + 1);
}
while( v10 < v13 );
}
if( v10 > v13 )
return -1073741811;
if( !FirstFree || (char *)FirstFree + (unsigned int)AceListLength > (char *)Acl + Acl->AclSize )
return -1073741789;
v16 = 0;
for( i = Acl + 1; v16 < v6; i = (PACL)((char *)i + i->AclSize) )
{
if( v16 >= Acl->AceCount )
break;
++v16;
}
v18 = (_DWORD)FirstFree - (_DWORD)i - 1;
v19 = v18;
if( v18 >= 0 )
{
v22 = (unsigned int)(v18 + AceListLength);
do
{
*(&i->AclRevision + v22) = *(&i->AclRevision + v19);
v22 = (unsigned int)(v22 - 1);
--v19;
}
while( v19 >= 0 );
}
if( (_DWORD)AceListLength )
{
v20 = (char *)((_BYTE *)AceList - (_BYTE *)i);
do
{
i->AclRevision = *(&i->AclRevision + (_QWORD)v20);
i = (PACL)((char *)i + 1);
--v12;
}
while( v12 );
}
Acl->AceCount += v14;
result = 0;
Acl->AclRevision = AclRevision;
return result;
}Referenced by:
AdtpBuildAccessReasonAuditStringInternal
LocalGetAclForString
PiDevCfgGetKeySecurityDescriptor
SepAppendAceToTokenDefaultDacl
SepAppendAceToTokenObjectAcl