RtlpAddKnownAce

INT64 __fastcall RtlpAddKnownAce(
        _ACL *Acl,
        UINT64 AceRevision,
        UINT64 AceFlags,
        UINT64 AccessMask,
        VOID *Sid,
        UINT8 NewType){
  int v6; 
  unsigned __int8 v7; 
  unsigned __int8 AclRevision; 
  unsigned __int8 v10; 
  int v11; 
  _ACL *v12; 
  unsigned int v13; 
  _ACL *v14; 
  unsigned __int16 v15; 
  INT64 result; 
  v6 = AccessMask;
  v7 = AceFlags;
  if( (unsigned __int64)Sid <= 0x7FFFFFFF0000i64 || (*(_BYTE *)Sid & 0xF) != 1 || *((_BYTE *)Sid + 1) > 0xFu )
    return 3221225592i64;
  AclRevision = Acl->AclRevision;
  if( AclRevision > 4u || (unsigned int)AceRevision > 4 )
    return 3221225561i64;
  v10 = AclRevision;
  if( AclRevision <= (unsigned __int8)AceRevision )
    v10 = AceRevision;
  v11 = AceFlags & 0xFFFFFFE0;
  if( (AceFlags & 0xFFFFFFE0) != 0 )
  {
    if( NewType == 2 )
    {
      v11 = AceFlags & 0xFFFFFF20;
    }
    else if( !NewType )
    {
      v11 = AceFlags & 0xFFFFFFC0;
    }
    if( v11 )
      return 3221225485i64;
  }
  if( !RtlValidAcl(Acl) )
    return 3221225591i64;
  v12 = Acl + 1;
  v13 = 0;
  if( Acl->AceCount )
  {
    while( v12 < (_ACL *)((char *)Acl + Acl->AclSize) )
    {
      ++v13;
      v12 = (_ACL *)((char *)v12 + v12->AclSize);
      if( v13 >= Acl->AceCount )
        goto LABEL_13;
    }
    return 3221225591i64;
  }
LABEL_13:
  v14 = (_ACL *)((char *)Acl + Acl->AclSize);
  if( v12 > v14 )
    v12 = 0i64;
  v15 = 4 * (*((unsigned __int8 *)Sid + 1) + 4);
  if( !v12 || (_ACL *)((char *)v12 + v15) > v14 )
    return 3221225625i64;
  v12->AclSize = v15;
  v12->Sbz1 = v7;
  v12->AclRevision = NewType;
  *(_DWORD *)&v12->AceCount = v6;
  memmove((UINT8 *)&v12[1], (UINT8 *)Sid, 4i64 * *((unsigned __int8 *)Sid + 1) + 8);
  ++Acl->AceCount;
  result = 0i64;
  Acl->AclRevision = v10;
  return result;
}

Referenced by:

BiCreateKeySecurityDescriptor
CMFCreateSecurityDescriptor
CmGetRegKeySecurityDescriptor
CmpAdminSystemSecurityDescriptor
CmpGenerateAppHiveSecurityDescriptor
CmpHiveRootSecurityDescriptor
DbgkpCreateNotificationEvent
DrvDbGetSecurityDescriptor
IopCreateDefaultDeviceSecurityDescriptor
LocalGetAclForString
MiCreateMemoryEventSD
MiSessionObjectCreate
NtSetUuidSeed
ObCreateKernelObjectsSD
ObpCreateDefaultObjectTypeSD
ObpGetDosDevicesProtection
ObpGetSilosRootDirectory
ObpVerifyAccessToBoundaryEntry
PfpCreateEvent
PiAuCheckTokenMembership
PiAuGetServiceStateSecurityObject
PiAuGetStateDirectorySecurityObject
PiDevCfgGetKeySecurityDescriptor
PiUEventInitClientRegistrationContext
PnpGetEnumSecurityDescriptor
PnpGetPropertiesSecurityDescriptor
PopCreateHiberFileSecurityDescriptor
PopCreateNotificationName
PspAllocateAndQueryNotificationChannel
PspAllocateAndQueryProcessNotificationChannel
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedAceEx
RtlAddAccessDeniedObjectAce
RtlAddAuditAccessAce
RtlAddAuditAccessAceEx
RtlAddAuditAccessObjectAce
RtlpSysVolCreateSecurityDescriptor
SepAppendAceToTokenObjectAcl
SepCreateImpersonationTokenDacl
SmKmStoreFileMakeSecurityDescriptor
sub_1405F50F8