RtlQueryInformationAcl
INT64 __fastcall RtlQueryInformationAcl(
_ACL *Acl,
void *AclInformation,
UINT64 AclInformationLength,
_ACL_INFORMATION_CLASS AclInformationClass){
int v4;
int AclRevision;
__int32 v8;
VOID *v9;
int v10;
VOID *v12;
v4 = 0;
AclRevision = Acl->AclRevision;
v12 = 0i64;
if( (unsigned __int8)(AclRevision - 2) <= 2u )
{
v8 = AclInformationClass - 1;
if( v8 )
{
if( v8 != 1 )
return 3221225475i64;
if( (unsigned int)AclInformationLength >= 0xC )
{
if( RtlFirstFreeAce(Acl, &v12) )
{
v9 = v12;
*(_DWORD *)AclInformation = Acl->AceCount;
if( v9 )
{
v10 = (_DWORD)v9 - (_DWORD)Acl;
*((_DWORD *)AclInformation + 1) = v10;
v4 = Acl->AclSize - v10;
}
else
{
*((_DWORD *)AclInformation + 1) = Acl->AclSize;
}
*((_DWORD *)AclInformation + 2) = v4;
return 0i64;
}
return 3221225485i64;
}
}
else if( (unsigned int)AclInformationLength >= 4 )
{
*(_DWORD *)AclInformation = AclRevision;
return 0i64;
}
return 3221225507i64;
}
return 3221225485i64;
}Referenced by:
SepAppendAceToTokenDefaultDacl
SepAppendAceToTokenObjectAcl