LocalConvertAclToString
UINT64 __stdcall LocalConvertAclToString(
ACL *Acl,
UINT8 AclPresent,
UINT8 ConvertAsDacl,
WCHAR **AclString,
UINT64 *AclStringSize,
VOID *RootDomainSid,
VOID *DomainSid,
UINT8 DefaultToDomain){
ACL *v9;
unsigned int v10;
__int16 v11;
unsigned int v12;
UINT64 v13;
void *v14;
void *v15;
UINT64 v16;
void *v17;
void *v18;
UINT64 v19;
void *v20;
_GUID *v21;
ACL *v22;
wchar_t **v23;
wchar_t *v24;
__int64 v25;
unsigned int v26;
int v27;
CHAR AclRevision;
int v29;
unsigned __int8 *v30;
ULONG AceCondition;
int v32;
int v33;
wchar_t **v34;
INT64 v35;
unsigned int v36;
int v37;
int v38;
wchar_t **v39;
wchar_t *v40;
__int64 v41;
WCHAR **v42;
WCHAR *v43;
__int64 v44;
INT64 v45;
WCHAR **v46;
INT64 v47;
__int64 v48;
__int64 v49;
NTSTATUS v50;
unsigned __int64 v51;
WCHAR **v52;
WCHAR *v53;
WCHAR *v54;
unsigned __int64 v55;
ACL *v56;
unsigned int v57;
WCHAR *v58;
UINT64 v59;
wchar_t **v60;
wchar_t **v61;
__int64 v62;
CHAR *v63;
unsigned int v64;
WCHAR *v65;
UINT64 v66;
INT64 v67;
__int64 v68;
__int64 v69;
UINT64 v70;
WCHAR *v71;
_GUID *v72;
unsigned __int8 v73;
__int64 v74;
int v75;
__int64 v76;
UINT64 v77;
WCHAR *v78;
UINT64 v79;
WCHAR *v80;
_QWORD *v81;
__int64 v82;
UINT64 v83;
WCHAR *v84;
WCHAR *v85;
__int64 v86;
wchar_t *v87;
WCHAR *v88;
unsigned __int64 v89;
ACL *v90;
unsigned int v91;
WCHAR **v92;
WCHAR **v93;
__int64 v94;
int v95;
wchar_t **v96;
wchar_t **v97;
unsigned int v98;
_BYTE *v99;
void *v101;
UINT64 v102;
WCHAR *v103;
__int64 v104;
bool v105;
WCHAR *v106;
unsigned int v107;
void *v108;
unsigned int v109;
unsigned int v110;
int v111;
__int64 v112;
unsigned __int8 *p_AceCount;
WCHAR *v114;
int v115;
unsigned int v116;
__int64 v117;
ACL *v118;
int v119;
unsigned int v120;
int v121;
wchar_t **v122;
wchar_t **v123;
__int64 v124;
PVOID v125;
__int64 v126;
int v127;
PVOID v128;
__int64 v129;
wchar_t *Str2;
unsigned int Val;
wchar_t v132[2];
INT64 v133;
PVOID P;
ULONG v135;
wchar_t *Src;
PSID Sid1;
ACL *v138;
INT64 a7;
PVOID v140;
PVOID v141;
int v142;
PVOID v143;
_GUID *v144;
unsigned int DefaultToDomaina;
char a6;
DefaultToDomaina = 0;
v9 = Acl;
v142 = 0;
v10 = 0;
v141 = 0i64;
Val = 0;
Sid1 = 0i64;
a7 = 0i64;
Src = 0i64;
if( !AclString || !AclStringSize )
return 87i64;
if( !AclPresent )
{
*AclString = 0i64;
*(_DWORD *)AclStringSize = 0;
return 0i64;
}
if( !Acl )
{
*AclString = 0i64;
*(_DWORD *)AclStringSize = 36;
SddlpAlloc(0x24u, AclPresent);
*AclString = v106;
if( !v106 )
{
v107 = 8;
LABEL_130:
*(_DWORD *)AclStringSize = 0;
return v107;
}
wcscpy(v106, L"NO_ACCESS_CONTROL");
return 0i64;
}
if( !Acl->AceCount )
{
*AclString = 0i64;
v107 = 0;
goto LABEL_130;
}
v11 = 8 * Acl->AceCount;
v12 = 2 - (ConvertAsDacl != 0);
LODWORD(v133) = v12;
SddlpAlloc(v11, AclPresent);
P = v14;
v15 = v14;
if( !v14 )
return 8i64;
SddlpAlloc(v9->AceCount, v13);
v143 = v17;
v18 = v17;
if( !v17 )
{
v108 = v15;
LABEL_132:
ExFreePoolWithTag(v108, 0);
return 8i64;
}
SddlpAlloc(4 * v9->AceCount, v16);
v140 = v20;
if( !v20 )
{
ExFreePoolWithTag(v15, 0);
v108 = v18;
goto LABEL_132;
}
v21 = 0i64;
v138 = v9 + 1;
v22 = v9 + 1;
if( !v9->AceCount )
goto LABEL_152;
while( 1 )
{
v10 += 2;
DefaultToDomaina = v10;
v23 = LookupAceTypeInTable(0i64, v22->AclRevision, v12);
if( !v23 )
{
LABEL_119:
AceCondition = 1336;
goto LABEL_53;
}
v24 = *v23;
v25 = -1i64;
do
++v25;
while( v24[v25] );
v26 = 0;
v27 = v10 + 2 + 2 * v25;
do
{
v19 = (unsigned int)(1 << v26);
if( ((unsigned __int8)v19 & v22->Sbz1) != 0 )
{
v42 = LookupAceFlagsInTable(0i64, v19, v12, v22->AclRevision);
if( v42 )
{
v43 = *v42;
v44 = -1i64;
do
++v44;
while( v43[v44] );
v27 += 2 * v44;
}
}
++v26;
}
while( v26 < 8 );
AclRevision = v22->AclRevision;
v10 = v27 + 2;
DefaultToDomaina = v10;
*(_DWORD *)v132 = v10;
if( (unsigned __int8)AclRevision > 0xBu )
{
if( AclRevision != 13 )
{
if( (unsigned __int8)AclRevision <= 0x10u )
goto LABEL_119;
v105 = (unsigned __int8)AclRevision <= 0x15u;
LABEL_118:
if( !v105 )
goto LABEL_119;
}
LABEL_19:
v29 = *(_DWORD *)&v22->AceCount;
v30 = (unsigned __int8 *)&v22[1];
Sid1 = &v22[1];
Val = v29;
goto LABEL_20;
}
if( AclRevision != 11 )
{
if( (unsigned __int8)AclRevision <= 3u )
goto LABEL_19;
if( (unsigned __int8)AclRevision <= 4u )
goto LABEL_119;
if( (unsigned __int8)AclRevision > 8u )
{
v105 = (unsigned __int8)AclRevision <= 0xAu;
goto LABEL_118;
}
}
v109 = *(_DWORD *)&v22->AceCount;
v110 = *(_DWORD *)&v22[1].AclRevision & 1;
Val = v109;
v111 = *(_DWORD *)&v22[1].AclRevision & 2;
v112 = 2i64 * v110;
v30 = (unsigned __int8 *)&v22[v112] + (v111 != 0 ? 28i64 : 12i64);
Sid1 = v30;
if( (-(__int64)(v110 != 0) & (unsigned __int64)&v22[1].AceCount) != 0 )
{
v10 += 72;
*(_DWORD *)v132 = v10;
}
if( v111 )
p_AceCount = (unsigned __int8 *)&v22[v112 + 1].AceCount;
else
p_AceCount = 0i64;
if( p_AceCount )
*(_DWORD *)v132 = v10 + 72;
v29 = v109;
LABEL_20:
if( Src )
{
ExFreePoolWithTag(Src, 0);
Src = 0i64;
}
v135 = 0;
AceCondition = LocalGetAceCondition(
(unsigned __int8 *)v22,
(char *)v30,
(size_t *)&Src,
&v135,
v132,
(__int64)RootDomainSid,
(__int64)DomainSid,
0i64,
a6);
if( AceCondition )
{
v10 = *(_DWORD *)v132;
DefaultToDomaina = *(_DWORD *)v132;
goto LABEL_150;
}
v32 = v133;
v33 = 0;
*((_DWORD *)v140 + (unsigned int)v21) = 0;
if( v22->AclRevision == 17 )
v32 = 4;
v34 = LookupAccessMaskInTable(0i64, v29, v32);
if( !v34 )
{
v36 = Val;
v37 = 0;
while( 1 )
{
if( (v36 & (1 << v37)) != 0 )
{
v38 = v133;
if( v22->AclRevision == 17 )
v38 = 4;
v39 = LookupAccessMaskInTable(0i64, v36 & (1 << v37), v38);
if( !v39 )
{
v33 = 20;
*((_DWORD *)v140 + (unsigned int)v21) = 2;
goto LABEL_41;
}
v40 = *v39;
v41 = -1i64;
do
++v41;
while( v40[v41] );
v33 += 2 * v41;
v36 = Val;
}
if( (unsigned int)++v37 >= 0x20 )
goto LABEL_41;
}
}
v49 = -1i64;
*((_DWORD *)v140 + (unsigned int)v21) = 1;
do
++v49;
while( (*v34)[v49] );
v33 = 2 * v49;
LABEL_41:
v10 = v33 + *(_DWORD *)v132 + 6;
DefaultToDomaina = v10;
v45 = LookupSidInTable(0i64, Sid1, (INT64)RootDomainSid, v35, Str2, a6, (INT64)&a7);
v19 = 0i64;
v46 = (WCHAR **)((char *)P + 8 * (unsigned int)v21);
if( !v45 )
break;
v47 = v45 + 2;
*v46 = (WCHAR *)(v45 + 2);
LABEL_43:
v48 = -1i64;
do
++v48;
while( *(_WORD *)(v47 + 2 * v48) );
v9 = Acl;
v10 += 2 * v48 + 4;
v22 = (ACL *)((char *)v22 + v22->AclSize);
DefaultToDomaina = v10;
LODWORD(v21) = (_DWORD)v21 + 1;
if( (unsigned int)v21 >= Acl->AceCount )
goto LABEL_53;
v12 = v133;
}
if( a7 )
{
SddlpAlloc(6u, 0i64);
*v46 = v114;
if( !v114 )
{
AceCondition = 8;
goto LABEL_150;
}
wcscpy_s(v114, 3ui64, (PWCHAR)L"SA");
v19 = 0i64;
goto LABEL_52;
}
v50 = LocalConvertSidToStringSidW(Sid1, (WCHAR **)P + (unsigned int)v21);
v19 = 0i64;
if( v50 >= 0 )
{
LABEL_52:
*((_BYTE *)v143 + (unsigned int)v21) = 1;
v47 = (INT64)*v46;
goto LABEL_43;
}
AceCondition = RtlNtStatusToDosError(v50);
LABEL_150:
v9 = Acl;
LABEL_53:
v21 = 0i64;
if( !v10 )
LABEL_152:
AceCondition = 1336;
if( AceCondition )
goto LABEL_188;
if( (v10 & 1) != 0 )
DefaultToDomaina = ++v10;
v51 = v10;
SddlpAlloc(v10, v19);
v52 = AclString;
v54 = v53;
*AclString = v53;
if( !v53 )
{
v10 = DefaultToDomaina;
AceCondition = 8;
goto LABEL_189;
}
v55 = v51 >> 1;
*(_DWORD *)v132 = 0;
if( !v9->AceCount )
goto LABEL_187;
v56 = v138;
while( 2 )
{
if( !v55 )
goto LABEL_186;
v57 = v133;
*v54 = 40;
v58 = v54 + 1;
v59 = v55 - 1;
v60 = LookupAceTypeInTable(0i64, v56->AclRevision, v57);
v61 = v60;
if( v60 )
{
wcscpy_s(v58, v59, *v60);
v62 = *((unsigned int *)v61 + 2);
v59 -= v62;
v58 += v62;
}
if( !v59 )
goto LABEL_186;
v63 = (CHAR *)v138;
*v58 = 59;
v64 = (unsigned int)v21;
v65 = v58 + 1;
v66 = v59 - 1;
do
{
v67 = (unsigned int)(1 << v64);
if( ((unsigned __int8)v67 & (unsigned __int8)v63[1]) != 0 )
{
v92 = LookupAceFlagsInTable(0i64, v67, v57, *v63);
v93 = v92;
if( v92 )
{
wcscpy_s(v65, v66, *v92);
v94 = *((unsigned int *)v93 + 2);
v66 -= v94;
v65 += v94;
}
v57 = v133;
}
++v64;
}
while( v64 < 8 );
v68 = *(unsigned int *)v132;
if( !v66 )
{
LABEL_186:
AceCondition = 1336;
goto LABEL_187;
}
v69 = (__int64)v138;
*v65 = 59;
v70 = v66 - 1;
v71 = v65 + 1;
v144 = v21;
v72 = v21;
a7 = (INT64)v21;
v73 = *(_BYTE *)v69;
if( *(_BYTE *)v69 > 0xBu )
{
if( v73 == 13 || v73 > 0x10u && v73 <= 0x15u )
goto LABEL_71;
}
else
{
if( *(_BYTE *)v69 == 11 )
goto LABEL_154;
if( v73 <= 3u )
goto LABEL_71;
if( v73 > 4u )
{
if( v73 > 8u )
{
if( v73 > 0xAu )
goto LABEL_72;
LABEL_71:
Val = *(_DWORD *)(v69 + 4);
Sid1 = (PSID)(v69 + 8);
goto LABEL_72;
}
LABEL_154:
v115 = *(_DWORD *)(v69 + 8) & 2;
v116 = *(_DWORD *)(v69 + 8) & 1;
v117 = 16i64 * v116;
Val = *(_DWORD *)(v69 + 4);
Sid1 = (PSID)(v69 + v117 + (v115 != 0 ? 28i64 : 12i64));
if( v115 )
v21 = (_GUID *)(v117 + v69 + 12);
else
v21 = 0i64;
a7 = (INT64)v21;
v72 = (_GUID *)((v69 + 12) & -(__int64)(v116 != 0));
v144 = v72;
}
}
LABEL_72:
v74 = (__int64)Src;
if( Src )
{
ExFreePoolWithTag(Src, 0);
v74 = 0i64;
Src = 0i64;
}
v135 = v74;
v135 = LocalGetAceCondition(
(unsigned __int8 *)v69,
(char *)Sid1,
(size_t *)&Src,
&v135,
&v142,
(__int64)RootDomainSid,
(__int64)DomainSid,
v74,
a6);
AceCondition = v135;
if( v135 )
goto LABEL_185;
v75 = *((_DWORD *)v140 + v68);
if( v75 == 2 )
{
wcscpy_s(v71, v70, (PWCHAR)L"0x");
v71 += 2;
v70 -= 2i64;
ultow_s(Val, v71, v70, 16);
v76 = -1i64;
do
++v76;
while( v71[v76] != (_WORD)v74 );
LABEL_78:
v71 += v76;
v70 -= v76;
}
else if( v75 == 1 )
{
v95 = v133;
if( v138->AclRevision == 17 )
v95 = 4;
v96 = LookupAccessMaskInTable(0i64, Val, v95);
v97 = v96;
if( v96 )
{
wcscpy_s(v71, v70, *v96);
v76 = *((unsigned int *)v97 + 2);
goto LABEL_78;
}
}
else
{
v118 = v138;
v119 = v133;
v120 = Val;
do
{
if( (v120 & (1 << v74)) != 0 )
{
v121 = v119;
if( v118->AclRevision == 17 )
v121 = 4;
v122 = LookupAccessMaskInTable(0i64, v120 & (1 << v74), v121);
v123 = v122;
if( v122 )
{
wcscpy_s(v71, v70, *v122);
v124 = *((unsigned int *)v123 + 2);
v70 -= v124;
v71 += v124;
}
v120 = Val;
}
LODWORD(v74) = v74 + 1;
}
while( (unsigned int)v74 < 0x20 );
AceCondition = v135;
v72 = v144;
v21 = (_GUID *)a7;
}
if( !v70 )
break;
v77 = v70 - 1;
*v71 = 59;
v78 = v71 + 1;
if( v72 )
{
if( !(unsigned int)SddlpUuidToString(v72, (WCHAR **)&v141) )
goto LABEL_185;
v125 = v141;
v126 = -1i64;
do
++v126;
while( *((_WORD *)v141 + v126) );
wcscpy_s(v78, v77, (PWCHAR)v141);
v77 -= v126;
v78 += v126;
if( v125 )
ExFreePoolWithTag(v125, 0);
}
if( v77 )
{
*v78 = 59;
v79 = v77 - 1;
v80 = v78 + 1;
if( v21 )
{
v127 = SddlpUuidToString(v21, (WCHAR **)&v141);
v21 = 0i64;
if( !v127 )
goto LABEL_187;
v128 = v141;
v129 = -1i64;
do
++v129;
while( *((_WORD *)v141 + v129) );
wcscpy_s(v80, v79, (PWCHAR)v141);
v79 -= v129;
v80 += v129;
if( v128 )
ExFreePoolWithTag(v128, 0);
}
v81 = P;
if( !v79 )
{
LABEL_183:
AceCondition = 1336;
LABEL_98:
v10 = DefaultToDomaina;
v52 = AclString;
goto LABEL_99;
}
v82 = *(unsigned int *)v132;
v83 = v79 - 1;
*v80 = 59;
v84 = v80 + 1;
v85 = (WCHAR *)v81[v82];
wcscpy_s(v84, v83, v85);
v86 = -1i64;
do
++v86;
while( v85[v86] != (_WORD)v21 );
v87 = Src;
v88 = &v84[v86];
v89 = v83 - v86;
if( Src )
{
if( !v89 )
goto LABEL_183;
v102 = v89 - 1;
*v88 = 59;
v103 = v88 + 1;
wcscpy_s(v103, v102, v87);
v104 = -1i64;
do
++v104;
while( v87[v104] != (_WORD)v21 );
v88 = &v103[v104];
v89 = v102 - v104;
}
if( v89 <= 1 )
goto LABEL_183;
v90 = v138;
*v88 = 41;
v91 = v82 + 1;
v54 = v88 + 1;
*(_DWORD *)v132 = v91;
v55 = v89 - 1;
*v54 = (unsigned __int16)v21;
v56 = (ACL *)((char *)v90 + v90->AclSize);
v138 = v56;
if( v91 >= Acl->AceCount )
goto LABEL_98;
continue;
}
break;
}
AceCondition = 1336;
LABEL_185:
v21 = 0i64;
LABEL_187:
v10 = DefaultToDomaina;
LABEL_188:
v52 = AclString;
LABEL_189:
v81 = P;
LABEL_99:
v98 = (unsigned int)v21;
if( (unsigned __int16)v21 < Acl->AceCount )
{
v99 = v143;
do
{
if( v99[v98] )
{
v101 = (void *)v81[v98];
if( v101 )
ExFreePoolWithTag(v101, 0);
}
++v98;
}
while( v98 < Acl->AceCount );
v21 = 0i64;
}
ExFreePoolWithTag(v81, 0);
ExFreePoolWithTag(v143, 0);
ExFreePoolWithTag(v140, 0);
if( Src )
ExFreePoolWithTag(Src, 0);
if( AceCondition )
{
if( *v52 )
ExFreePoolWithTag(*v52, 0);
*v52 = (WCHAR *)v21;
*(_DWORD *)AclStringSize = (_DWORD)v21;
}
else
{
*(_DWORD *)AclStringSize = v10;
}
return AceCondition;
}Referenced by:
LocalConvertSDToStringSD_Rev1