RtlAddAccessFilterAce

INT64 __fastcall RtlAddAccessFilterAce(
        ACL *Acl,
        UINT64 a2,
        INT64 a3,
        INT64 a4,
        CHAR a5,
        INT64 a6,
        UINT8 *Src,
        INT16 a8){
  int v9; 
  unsigned int v10; 
  INT64 result; 
  int v13; 
  unsigned int AclRevision; 
  unsigned __int8 v15; 
  unsigned int v16; 
  unsigned int v17; 
  PACE v18; 
  PACE v19; 
  BYTE v20; 
  PACE Ace; 
  int v22; 
  unsigned __int16 v23; 
  v20 = a3;
  Ace = 0i64;
  v9 = a3;
  v22 = 0;
  v10 = a2;
  v23 = 256;
  if( !Acl || !RtlValidAcl(Acl) )
    return 3221225591i64;
  if( !Src || (unsigned __int16)(a8 - 6) > 0xFFF8u || *(_DWORD *)Src != 2020897377 || a5 != 21 )
    return 3221225485i64;
  if( !RtlValidSid((PVOID)a4) )
    return 3221225592i64;
  if( (v9 & 0x40) != 0 )
  {
    if( !RtlIsValidProcessTrustLabelSid((PVOID)a4) )
      return 3221225485i64;
  }
  else
  {
    v13 = *(_DWORD *)(a4 + 2) - v22;
    if( !v13 )
      v13 = *(unsigned __int16 *)(a4 + 6) - v23;
    if( v13 || *(_BYTE *)(a4 + 1) != 1 || *(_DWORD *)(a4 + 8) )
      return 3221225485i64;
  }
  AclRevision = Acl->AclRevision;
  if( (unsigned __int8)AclRevision > 4u || v10 > 4 )
    return 3221225561i64;
  v15 = Acl->AclRevision;
  if( AclRevision <= v10 )
    v15 = v10;
  if( (v9 & 0xFFFFFFA0) != 0 || (a6 & 0xFF000000) != 0 )
    return 3221225485i64;
  if( !RtlFirstFreeAce(Acl, (VOID **)&Ace) )
    return 3221225591i64;
  v16 = ((unsigned __int16)a8 + 3) & 0xFFFFFFFC;
  v17 = v16 + 4 * (*(unsigned __int8 *)(a4 + 1) + 4);
  if( v17 < v16 )
    return 3221225621i64;
  if( v17 > 0xFFFF )
    return 3221225485i64;
  v18 = Ace;
  if( !Ace || (char *)Ace + v17 > (char *)Acl + Acl->AclSize )
    return 3221225625i64;
  v19 = Ace + 1;
  Ace->Header.AceSize = v17;
  v18->Header.AceFlags = v20;
  v18->Header.AceType = 21;
  v18->AccessMask = a6;
  RtlCopySid(4 * *(unsigned __int8 *)(a4 + 1) + 8, v19, (PSID)a4);
  memmove((UINT8 *)&v18[2] + 4 * *(unsigned __int8 *)(a4 + 1), Src, (unsigned __int16)a8);
  ++Acl->AceCount;
  result = 0i64;
  Acl->AclRevision = v15;
  return result;
}

Referenced by: