RtlSelfRelativeToAbsoluteSD

INT64 __fastcall RtlSelfRelativeToAbsoluteSD(
        VOID *SelfRelativeSecurityDescriptor,
        VOID *AbsoluteSecurityDescriptor,
        UINT64 *AbsoluteSecurityDescriptorSize,
        _ACL *Dacl,
        UINT64 *DaclSize,
        _ACL *Sacl,
        UINT64 *SaclSize,
        VOID *Owner,
        UINT64 *OwnerSize,
        VOID *PrimaryGroup,
        UINT64 *PrimaryGroupSize){
  UINT8 *v14; 
  UINT64 *v15; 
  UINT64 *v16; 
  UINT64 *v17; 
  UINT64 *v18; 
  int v19; 
  int v20; 
  int v21; 
  int v22; 
  UINT8 *v23; 
  VOID *v24; 
  VOID *v25; 
  INT64 result; 
  _ACL *v27; 
  UINT64 v28; 
  PVOID v29; 
  PVOID v30; 
  UINT8 *v31; 
  UINT8 *Src; 
  UINT64 v33; 
  UINT64 v34; 
  LODWORD(v33) = 0;
  LODWORD(v34) = 0;
  v28 = 0i64;
  v29 = 0i64;
  v30 = 0i64;
  Src = 0i64;
  v31 = 0i64;
  if( *((__int16 *)SelfRelativeSecurityDescriptor + 1) >= 0 )
    return 3221225703i64;
  RtlpQuerySecurityDescriptor(
    (SECURITY_DESCRIPTOR *)SelfRelativeSecurityDescriptor,
    &v29,
    &v28,
    &v30,
    (UINT64 *)((char *)&v28 + 4),
    (ACL **)&Src,
    &v33,
    (ACL **)&v31,
    &v34);
  v15 = PrimaryGroupSize;
  v16 = OwnerSize;
  v17 = SaclSize;
  v18 = DaclSize;
  v19 = v33;
  v20 = v34;
  v21 = v28;
  v22 = HIDWORD(v28);
  if( AbsoluteSecurityDescriptor
    && *(_DWORD *)AbsoluteSecurityDescriptorSize >= 0x28u
    && (unsigned int)v28 <= *(_DWORD *)OwnerSize
    && (unsigned int)v33 <= *(_DWORD *)DaclSize
    && (unsigned int)v34 <= *(_DWORD *)SaclSize
    && HIDWORD(v28) <= *(_DWORD *)PrimaryGroupSize )
  {
    memmove((UINT8 *)AbsoluteSecurityDescriptor, v14, 0x14ui64);
    v23 = (UINT8 *)v29;
    *((_WORD *)AbsoluteSecurityDescriptor + 1) &= ~0x8000u;
    *((_QWORD *)AbsoluteSecurityDescriptor + 1) = 0i64;
    *((_QWORD *)AbsoluteSecurityDescriptor + 2) = 0i64;
    *((_QWORD *)AbsoluteSecurityDescriptor + 3) = 0i64;
    *((_QWORD *)AbsoluteSecurityDescriptor + 4) = 0i64;
    if( v23 )
    {
      v24 = Owner;
      memmove((UINT8 *)Owner, v23, 4i64 * v23[1] + 8);
      *((_QWORD *)AbsoluteSecurityDescriptor + 1) = v24;
    }
    if( v30 )
    {
      v25 = PrimaryGroup;
      memmove((UINT8 *)PrimaryGroup, (UINT8 *)v30, 4i64 * *((unsigned __int8 *)v30 + 1) + 8);
      *((_QWORD *)AbsoluteSecurityDescriptor + 2) = v25;
    }
    if( v31 )
    {
      v27 = Sacl;
      memmove((UINT8 *)Sacl, v31, *((unsigned __int16 *)v31 + 1));
      *((_QWORD *)AbsoluteSecurityDescriptor + 3) = v27;
    }
    if( Src )
    {
      memmove((UINT8 *)Dacl, Src, *((unsigned __int16 *)Src + 1));
      *((_QWORD *)AbsoluteSecurityDescriptor + 4) = Dacl;
    }
    return 0i64;
  }
  else
  {
    *(_DWORD *)AbsoluteSecurityDescriptorSize = 40;
    *(_DWORD *)v15 = v22;
    result = 3221225507i64;
    *(_DWORD *)v16 = v21;
    *(_DWORD *)v17 = v20;
    *(_DWORD *)v18 = v19;
  }
  return result;
}

Referenced by:

No references.