LocalGetAclForString
UINT64 __stdcall LocalGetAclForString(WCHAR *AclString, UINT8 ConvertAsDacl, ACL **Acl, WCHAR **End){
ACL **v5;
WCHAR *v7;
unsigned int RelativeAttributeForString;
PSID v9;
UINT64 result;
WCHAR *v11;
__int64 v12;
WCHAR *v13;
UINT64 v14;
int v15;
unsigned int v16;
ACL *v17;
__int16 v18;
ACCESS_MASK v19;
WCHAR v20;
WCHAR v21;
wchar_t *v22;
unsigned int v23;
wchar_t **v24;
unsigned int v25;
__int64 v26;
wchar_t *v27;
wchar_t *v28;
WCHAR **v29;
WCHAR v30;
int v31;
wchar_t **v32;
__int64 v33;
int v34;
unsigned int SidForString;
WCHAR *v36;
WCHAR *i;
int v38;
unsigned int v39;
unsigned int v40;
unsigned int v41;
unsigned int v42;
int v43;
unsigned int v44;
UINT64 v45;
PVOID *v46;
UINT64 v47;
_ACL *v48;
NTSTATUS v49;
NTSTATUS v50;
UINT8 *v51;
WCHAR **v52;
ACL *v53;
bool v54;
int v55;
unsigned int v56;
bool v57;
unsigned __int64 v58;
unsigned int v59;
__int64 v60;
__int64 v61;
UINT8 **v62;
UINT8 *v63;
_ACL *v64;
unsigned int v65;
_WORD *v66;
char v67;
UINT64 v68;
int v69;
UINT8 *v70;
unsigned int v71;
unsigned int v72;
unsigned int v73;
unsigned int v74;
unsigned int v75;
int v76;
__int64 v77;
__int64 v78;
ULONG v79;
UINT64 v80;
unsigned int v81;
UINT8 *v82;
__int64 v83;
PSID v84;
ULONG v85;
GUID *ObjectTypeGuid;
GUID *InheritedObjectTypeGuid;
UINT8 InheritedObjectTypeGuida;
unsigned __int8 v89;
int v90;
char FreeSid[8];
PSID Sid;
ACCESS_MASK AccessMask;
char v94;
size_t RelativeAttributeSize;
UINT8 **v96;
PVOID P;
UINT64 AceCount;
WCHAR *Enda;
unsigned int Size;
int Size_4;
GUID *v102;
GUID *p_Guid;
PVOID v104;
INT64 v105;
wchar_t *EndPtr;
PVOID Ace;
WCHAR **v108;
int v109;
unsigned __int16 v110;
GUID Guid;
GUID v112;
wchar_t Dst[40];
v108 = End;
v96 = (UINT8 **)Acl;
LODWORD(AceCount) = 0;
v5 = Acl;
EndPtr = 0i64;
FreeSid[0] = 0;
v7 = AclString;
Sid = 0i64;
RelativeAttributeForString = 0;
P = 0i64;
v9 = 0i64;
RelativeAttributeSize = 0i64;
v104 = 0i64;
Ace = 0i64;
Enda = 0i64;
v109 = 0;
v110 = 256;
if( !AclString || !Acl || !End )
return 87i64;
if( !wcsnicmp(AclString, L"NO_ACCESS_CONTROL", 0x11ui64) )
{
*v5 = 0i64;
*End = v7 + 17;
goto LABEL_87;
}
LODWORD(v105) = 2 - (ConvertAsDacl != 0);
result = LocalGetSDDLDeliminator(v7, End);
if( (_DWORD)result )
return result;
v11 = *End;
if( *End == v7 )
return 87i64;
if( v11 )
{
v13 = v11 - 1;
}
else
{
v12 = -1i64;
do
++v12;
while( v7[v12] );
v13 = &v7[v12];
}
*End = v13;
RelativeAttributeForString = LocalGetAceCount(v7, v13, &AceCount);
if( RelativeAttributeForString )
goto LABEL_87;
v15 = AceCount;
if( !(_DWORD)AceCount )
{
SddlpAlloc(8u, v14);
*v5 = v53;
if( v53 )
{
v53->AclRevision = 2;
(*v5)->Sbz1 = 0;
(*v5)->AclSize = 8;
(*v5)->AceCount = 0;
(*v5)->Sbz2 = 0;
}
else
{
return 8;
}
return RelativeAttributeForString;
}
v16 = 84 * AceCount + 8;
if( v16 > 0xFFFF )
v16 = 0xFFFF;
Size = v16;
SddlpAlloc(v16, v14);
*v5 = v17;
if( !v17 )
{
RelativeAttributeForString = 8;
goto LABEL_87;
}
v17->AclRevision = 2;
v18 = 8;
v90 = 8;
(*v5)->Sbz1 = 0;
(*v5)->AclSize = v16;
(*v5)->AceCount = 0;
(*v5)->Sbz2 = 0;
Size_4 = 0;
if( !v15 )
goto LABEL_84;
while( 2 )
{
v89 = 0;
AccessMask = 0;
Guid = 0i64;
v19 = 0;
p_Guid = 0i64;
v112 = 0i64;
v102 = 0i64;
while( 1 )
{
v20 = *v7;
if( *v7 != 32 )
break;
++v7;
}
v21 = *v7;
if( v20 == 40 )
v21 = v7[1];
v22 = v7 + 1;
if( v20 != 40 )
v22 = v7;
if( v21 == 32 )
{
do
++v22;
while( *v22 == 32 );
}
v23 = v105;
v24 = LookupAceTypeInTable(v22, 0, v105);
if( !v24 )
{
RelativeAttributeForString = 1804;
goto LABEL_83;
}
v25 = *((unsigned __int8 *)v24 + 12);
v26 = *((unsigned int *)v24 + 2);
v94 = v25;
v27 = &v22[v26];
if( *v27 != 59 && *v27 != 32 )
goto LABEL_110;
v28 = v27 + 1;
if( (unsigned __int8)(v25 - 5) <= 3u || (_BYTE)v25 == 11 )
(*v5)->AclRevision = 4;
while( *v28 == 32 )
++v28;
v29 = v108;
while( 1 )
{
if( v28 == *v29 )
goto LABEL_33;
if( *v28 == 59 )
break;
for( ; *v28 == 32; ++v28 )
;
v52 = LookupAceFlagsInTable(v28, 0i64, v23, v25);
if( !v52 )
{
RelativeAttributeForString = 1004;
goto LABEL_83;
}
v89 |= *((_BYTE *)v52 + 12);
v28 += *((unsigned int *)v52 + 2);
}
do
{
++v28;
LABEL_33:
v30 = *v28;
}
while( *v28 == 32 );
while( v30 != 59 )
{
if( v30 == 32 )
{
do
++v28;
while( *v28 == 32 );
}
v31 = v23;
if( (_BYTE)v25 == 17 )
v31 = 4;
v32 = LookupAccessMaskInTable(v28, 0, v31);
if( v32 )
{
v19 |= *((_DWORD *)v32 + 3);
v33 = *((unsigned int *)v32 + 2);
AccessMask = v19;
v28 += v33;
}
else
{
v19 |= wcstoul(v28, &EndPtr, 0i64);
AccessMask = v19;
if( EndPtr == v28 )
goto LABEL_110;
v28 = EndPtr;
}
v30 = *v28;
}
v34 = 0;
LABEL_42:
++v28;
while( 1 )
{
if( *v28 == 32 )
goto LABEL_42;
if( *v28 != 59 )
break;
LABEL_45:
++v28;
if( (unsigned int)++v34 >= 2 )
goto LABEL_46;
}
if( (unsigned __int8)(v25 - 5) > 3u && (_BYTE)v25 != 11 )
goto LABEL_110;
wcsncpy_s(Dst, 0x25ui64, v28, 0x24ui64);
Dst[36] = 0;
if( !v34 )
{
if( !(unsigned int)SddlpUuidFromString(Dst, &Guid) )
goto LABEL_126;
p_Guid = &Guid;
goto LABEL_124;
}
if( (unsigned int)SddlpUuidFromString(Dst, &v112) )
{
v102 = &v112;
LABEL_124:
v28 += 36;
if( *v28 != 59 && *v28 != 32 )
{
LABEL_126:
RelativeAttributeForString = 1705;
goto LABEL_83;
}
goto LABEL_45;
}
RelativeAttributeForString = 1705;
LABEL_46:
if( RelativeAttributeForString )
goto LABEL_83;
while( *v28 == 32 )
++v28;
SidForString = LocalGetSidForString(
v28,
&Sid,
&Enda,
(UINT8 *)FreeSid,
ObjectTypeGuid,
(UINT8)InheritedObjectTypeGuid);
v9 = Sid;
RelativeAttributeForString = SidForString;
if( SidForString )
goto LABEL_83;
v36 = Enda;
if( !Enda || !Sid )
{
LABEL_110:
RelativeAttributeForString = 1336;
LABEL_83:
v18 = v90;
goto LABEL_84;
}
for( i = Enda; *i == 32; ++i )
;
if( (unsigned __int8)v25 > 0x15u || (v38 = 2371072, !_bittest(&v38, v25)) )
{
v39 = RelativeAttributeSize;
v40 = HIDWORD(RelativeAttributeSize);
goto LABEL_55;
}
if( *i == 59 )
{
do
++i;
while( *i == 32 );
if( *i == 40 )
{
if( P )
{
ExFreePoolWithTag(P, 0);
P = 0i64;
}
LODWORD(RelativeAttributeSize) = 0;
if( v104 )
{
ExFreePoolWithTag(v104, 0);
v104 = 0i64;
}
HIDWORD(RelativeAttributeSize) = 0;
if( (_BYTE)v25 == 18 )
{
InheritedObjectTypeGuid = 0i64;
ObjectTypeGuid = 0i64;
RelativeAttributeForString = LocalGetRelativeAttributeForString(
i,
&Enda,
(CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 **)&v104,
(size_t *)((char *)&RelativeAttributeSize + 4));
if( RelativeAttributeForString )
{
LABEL_155:
v18 = v90;
goto LABEL_84;
}
}
else
{
InheritedObjectTypeGuid = 0i64;
ObjectTypeGuid = 0i64;
RelativeAttributeForString = LocalGetConditionForString(i, &Enda, (UINT8 **)&P, &RelativeAttributeSize);
}
v36 = Enda;
}
else
{
v36 = i;
Enda = i;
}
}
v39 = RelativeAttributeSize;
v40 = HIDWORD(RelativeAttributeSize);
if( !RelativeAttributeSize )
goto LABEL_154;
if( RelativeAttributeForString )
goto LABEL_155;
LABEL_55:
while( *v36 == 32 )
Enda = ++v36;
if( *v36 != 41 )
goto LABEL_154;
v7 = v36 + 1;
v41 = v25;
if( v25 > 0x11 )
{
if( v25 == 18 )
{
v42 = v40 + 12;
v57 = v40 + 12 < v40;
goto LABEL_171;
}
if( v25 == 19 || v25 == 20 )
{
LABEL_60:
v42 = 12;
goto LABEL_61;
}
v54 = v25 == 21;
LABEL_153:
if( v54 )
{
LABEL_162:
if( v39 > 0xFFFFFFFC )
goto LABEL_163;
v56 = (v39 + 3) & 0xFFFFFFFC;
v42 = v56 + 12;
LABEL_161:
v57 = v42 < v56;
LABEL_171:
if( v57 )
{
RelativeAttributeForString = 534;
goto LABEL_83;
}
LABEL_61:
v43 = RtlLengthSid(v9);
v18 = v90;
v44 = v42 + v43 - 4;
if( v44 < v42 )
{
RelativeAttributeForString = 534;
}
else
{
if( v44 + v90 >= v44 )
{
v45 = Size;
if( v44 + v90 > Size )
{
v58 = v44 * (unsigned __int64)(unsigned int)(AceCount - Size_4);
if( v58 > 0xFFFFFFFF || (v59 = v58 + Size, (unsigned int)v58 + Size < (unsigned int)v58) )
{
v9 = Sid;
RelativeAttributeForString = 534;
goto LABEL_83;
}
SddlpAlloc(v59, Size);
v61 = v60;
v62 = v96;
v63 = *v96;
if( !v61 )
{
if( v63 )
{
ExFreePoolWithTag(v63, 0);
v62 = v96;
}
v54 = FreeSid[0] == 1;
*v62 = 0i64;
if( v54 )
{
if( Sid )
ExFreePoolWithTag(Sid, 0);
v9 = 0i64;
FreeSid[0] = 0;
}
else
{
v9 = Sid;
}
RelativeAttributeForString = 8;
goto LABEL_83;
}
memmove((UINT8 *)v61, *v96, Size);
v46 = (PVOID *)v96;
*(_WORD *)(v61 + 2) = v59;
if( *v46 )
{
ExFreePoolWithTag(*v46, 0);
v46 = (PVOID *)v96;
}
*v46 = (PVOID)v61;
v39 = RelativeAttributeSize;
Size = v59;
}
else
{
v46 = (PVOID *)v96;
}
v90 += v44;
if( v41 > 0xB )
{
v71 = v41 - 13;
if( !v71 )
goto LABEL_229;
v72 = v71 - 4;
if( !v72 )
{
v9 = Sid;
LODWORD(InheritedObjectTypeGuid) = AccessMask;
v49 = SddlAddMandatoryAce(
(_ACL *)*v46,
v45,
v89,
Sid,
(UINT8)ObjectTypeGuid,
(UINT64)InheritedObjectTypeGuid);
goto LABEL_71;
}
v73 = v72 - 1;
if( v73 )
{
v74 = v73 - 1;
if( !v74 )
{
v9 = Sid;
v49 = SddlAddScopedPolicyIDAce((_ACL *)*v46, v45, v89, AccessMask, Sid);
goto LABEL_71;
}
v75 = v74 - 1;
if( !v75 )
{
v9 = Sid;
LOBYTE(InheritedObjectTypeGuid) = AccessMask;
v49 = SddlAddProcessTrustLabelAce((ACL *)*v46, v45, v89, Sid);
goto LABEL_71;
}
if( v75 != 1 )
{
LABEL_185:
v9 = Sid;
v50 = -1073741811;
LABEL_247:
RelativeAttributeForString = RtlNtStatusToDosError(v50);
goto LABEL_83;
}
v9 = Sid;
if( v39 < 0xFFFF )
{
LODWORD(InheritedObjectTypeGuid) = AccessMask;
v49 = SddlAddAccessFilterAce(
(ACL *)*v46,
v45,
v89,
(INT64)Sid,
(INT64)ObjectTypeGuid,
(INT64)InheritedObjectTypeGuid,
(UINT8 *)P,
v39);
goto LABEL_71;
}
}
else
{
if( v44 >= 0xFFFF )
{
LABEL_245:
v9 = Sid;
goto LABEL_246;
}
v9 = Sid;
if( (v89 & 0xE0) == 0 && !AccessMask )
{
v76 = *(_DWORD *)((char *)Sid + 2) - v109;
if( !v76 )
v76 = *((unsigned __int16 *)Sid + 3) - v110;
if( !v76 && *((_BYTE *)Sid + 1) == 1 && !*((_DWORD *)Sid + 2) )
{
SddlpAlloc(v44, v45);
v78 = v77;
if( v77 )
{
*(_BYTE *)v77 = v94;
*(_BYTE *)(v77 + 1) = v89;
*(_WORD *)(v77 + 2) = v44;
*(_DWORD *)(v77 + 4) = 0;
v79 = RtlLengthSid(v9);
RtlCopySid(v79, (PSID)(v78 + 8), v9);
if( HIDWORD(RelativeAttributeSize) )
{
v80 = HIDWORD(RelativeAttributeSize);
v81 = RtlLengthSid(v9);
v82 = (UINT8 *)v104;
LABEL_233:
memmove((UINT8 *)(v78 + v81 + 8i64), v82, v80);
}
LABEL_234:
LODWORD(ObjectTypeGuid) = v44;
v50 = RtlAddAce((_ACL *)*v96, 2ui64, 0xFFFFFFFFui64, (VOID *)v78, (UINT64)ObjectTypeGuid);
ExFreePoolWithTag((PVOID)v78, 0);
goto LABEL_72;
}
LABEL_227:
v50 = -1073741801;
goto LABEL_72;
}
}
}
}
else
{
if( v41 != 11 )
{
switch( v41 )
{
case 0u:
InheritedObjectTypeGuida = 0;
LABEL_69:
v47 = v89;
v48 = (_ACL *)*v46;
LABEL_70:
v9 = Sid;
v49 = RtlpAddKnownAce(v48, 2ui64, v47, AccessMask, Sid, InheritedObjectTypeGuida);
LABEL_71:
v50 = v49;
goto LABEL_72;
case 1u:
InheritedObjectTypeGuida = 1;
goto LABEL_69;
case 2u:
v64 = (_ACL *)*v46;
InheritedObjectTypeGuida = 2;
v65 = v89 & 0x3F | 0x40;
if( (v89 & 0x40) == 0 )
v65 = v89 & 0x3F;
v48 = v64;
v47 = v65;
LODWORD(v47) = v65 | 0x80;
if( (v89 & 0x80u) == 0 )
v47 = v65;
goto LABEL_70;
case 5u:
v9 = Sid;
v49 = RtlAddAccessAllowedObjectAce((_ACL *)*v46, 4ui64, v89, AccessMask, p_Guid, v102, Sid);
goto LABEL_71;
case 6u:
v9 = Sid;
v49 = RtlAddAccessDeniedObjectAce((_ACL *)*v46, 4ui64, v89, AccessMask, p_Guid, v102, Sid);
goto LABEL_71;
case 7u:
v9 = Sid;
v49 = RtlAddAuditAccessObjectAce(
(ACL *)*v46,
4ui64,
v89,
AccessMask,
p_Guid,
v102,
Sid,
v89 & 0x40,
v89 & 0x80);
goto LABEL_71;
}
if( v41 <= 8 )
goto LABEL_185;
LABEL_229:
if( v44 < 0xFFFF )
{
SddlpAlloc(v44, v45);
v9 = Sid;
v78 = v83;
if( v83 )
{
v84 = Sid;
*(_BYTE *)v83 = v94;
*(_DWORD *)(v83 + 4) = AccessMask;
*(_BYTE *)(v83 + 1) = v89;
*(_WORD *)(v83 + 2) = v44;
v85 = RtlLengthSid(v84);
RtlCopySid(v85, (PSID)(v78 + 8), v9);
if( (_DWORD)RelativeAttributeSize )
{
v80 = (unsigned int)RelativeAttributeSize;
v81 = RtlLengthSid(v9);
v82 = (UINT8 *)P;
goto LABEL_233;
}
goto LABEL_234;
}
goto LABEL_227;
}
goto LABEL_245;
}
v9 = Sid;
if( v44 < 0xFFFF )
{
v50 = RtlAddAccessAllowedObjectAce((_ACL *)*v46, 4ui64, v89, AccessMask, p_Guid, v102, Sid);
if( v50 < 0 )
goto LABEL_247;
v50 = RtlGetAce((ACL *)*v96, (unsigned int)*((unsigned __int16 *)*v96 + 2) - 1, &Ace);
if( v50 < 0 )
goto LABEL_247;
v66 = Ace;
v67 = 9;
if( *(_BYTE *)Ace == 5 )
v67 = 11;
*(_BYTE *)Ace = v67;
v66[1] = v44;
if( (_DWORD)RelativeAttributeSize )
{
v68 = (unsigned int)RelativeAttributeSize;
if( *(_BYTE *)v66 == 11 )
{
v69 = *((_DWORD *)v66 + 2);
v70 = (UINT8 *)&v66[8 * (v69 & 1) + 6 + 4 * (v69 & 2)] + (unsigned int)RtlLengthSid(Sid);
}
else
{
v70 = (UINT8 *)v66 + (unsigned int)RtlLengthSid(Sid) + 8;
}
memmove(v70, (UINT8 *)P, v68);
}
v9 = Sid;
LABEL_72:
if( v50 >= 0 )
{
if( FreeSid[0] == 1 )
ExFreePoolWithTag(v9, 0);
v9 = 0i64;
Sid = 0i64;
if( P )
{
ExFreePoolWithTag(P, 0);
P = 0i64;
}
LODWORD(RelativeAttributeSize) = 0;
if( v104 )
{
ExFreePoolWithTag(v104, 0);
v104 = 0i64;
}
HIDWORD(RelativeAttributeSize) = 0;
if( *v7 == 40 )
++v7;
if( ++Size_4 < (unsigned int)AceCount )
{
v5 = (ACL **)v96;
continue;
}
goto LABEL_83;
}
goto LABEL_247;
}
}
LABEL_246:
v50 = -1073741705;
goto LABEL_247;
}
v9 = Sid;
RelativeAttributeForString = 534;
}
LABEL_84:
v51 = *v96;
if( RelativeAttributeForString )
{
if( v51 )
ExFreePoolWithTag(*v96, 0);
*v96 = 0i64;
}
else
{
*((_WORD *)v51 + 1) = v18;
}
if( FreeSid[0] && v9 )
ExFreePoolWithTag(v9, 0);
goto LABEL_87;
}
LABEL_154:
RelativeAttributeForString = 1336;
goto LABEL_155;
}
break;
}
if( v25 == 17 || v25 <= 3 )
goto LABEL_60;
if( v25 <= 4 )
goto LABEL_154;
if( v25 <= 8 )
{
v42 = p_Guid != 0i64 ? 32 : 16;
if( v102 )
v42 = p_Guid != 0i64 ? 48 : 32;
goto LABEL_61;
}
if( v25 <= 0xA )
goto LABEL_162;
if( v25 != 11 )
{
v54 = v25 == 13;
goto LABEL_153;
}
v55 = p_Guid != 0i64 ? 48 : 32;
if( !v102 )
v55 = p_Guid != 0i64 ? 32 : 16;
if( v39 <= 0xFFFFFFFC )
{
v56 = (v39 + 3) & 0xFFFFFFFC;
v42 = v56 + v55;
goto LABEL_161;
}
LABEL_163:
RelativeAttributeForString = 534;
LABEL_87:
if( P )
ExFreePoolWithTag(P, 0);
if( v104 )
ExFreePoolWithTag(v104, 0);
return RelativeAttributeForString;
}Referenced by:
LocalConvertStringSDToSD_Rev1