SepSecurityDescriptorStrictLength
UINT64 __fastcall SepSecurityDescriptorStrictLength(VOID *SecurityDescriptor){
__int16 v1;
__int64 v2;
unsigned int v3;
char *v4;
__int64 v5;
char *v6;
__int64 v7;
char *v8;
__int64 v9;
char *v10;
__int64 v11;
char *v12;
__int64 v13;
char *v14;
__int64 v15;
char *v16;
__int64 v17;
char *v18;
v1 = *((_WORD *)SecurityDescriptor + 1);
v2 = 20i64;
if( v1 >= 0 )
v2 = 40i64;
v3 = v2;
v4 = (char *)SecurityDescriptor + v2;
if( v1 >= 0 )
{
v6 = (char *)*((_QWORD *)SecurityDescriptor + 1);
}
else
{
v5 = *((unsigned int *)SecurityDescriptor + 1);
if( !(_DWORD)v5 )
goto LABEL_9;
v6 = (char *)SecurityDescriptor + v5;
}
if( v6 )
{
v3 += (4 * (unsigned __int8)v6[1] + 11) & 0xFFFFFFFC;
v4 = &v6[(4 * (unsigned __int8)v6[1] + 11) & 0xFFFFFFFC];
}
LABEL_9:
if( v1 >= 0 )
{
v8 = (char *)*((_QWORD *)SecurityDescriptor + 2);
}
else
{
v7 = *((unsigned int *)SecurityDescriptor + 2);
if( !(_DWORD)v7 )
goto LABEL_16;
v8 = (char *)SecurityDescriptor + v7;
}
if( v8 )
{
v9 = (4 * (unsigned __int8)v8[1] + 11) & 0xFFFFFFFC;
v10 = &v8[v9];
v3 += v9;
if( v10 > v4 )
v4 = v10;
}
LABEL_16:
if( (v1 & 4) == 0 )
goto LABEL_24;
if( v1 >= 0 )
{
v12 = (char *)*((_QWORD *)SecurityDescriptor + 4);
}
else
{
v11 = *((unsigned int *)SecurityDescriptor + 4);
if( !(_DWORD)v11 )
goto LABEL_24;
v12 = (char *)SecurityDescriptor + v11;
}
if( v12 )
{
v13 = (*((unsigned __int16 *)v12 + 1) + 3) & 0xFFFFFFFC;
v14 = &v12[v13];
v3 += v13;
if( v14 > v4 )
v4 = v14;
}
LABEL_24:
if( (v1 & 0x10) == 0 )
goto LABEL_32;
if( v1 >= 0 )
{
v16 = (char *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v15 = *((unsigned int *)SecurityDescriptor + 3);
if( !(_DWORD)v15 )
goto LABEL_32;
v16 = (char *)SecurityDescriptor + v15;
}
if( v16 )
{
v17 = (*((unsigned __int16 *)v16 + 1) + 3) & 0xFFFFFFFC;
v18 = &v16[v17];
v3 += v17;
if( v18 > v4 )
LODWORD(v4) = (_DWORD)v18;
}
LABEL_32:
if( v1 < 0 )
return(unsigned int)((_DWORD)v4 - (_DWORD)SecurityDescriptor);
else
return v3;
}Referenced by:
RtlLengthSecurityDescriptorStrict
SeOperationAuditAlarm
SepAdtOpenObjectAuditAlarm
SepAdtSecurityDescriptorChangedAuditAlarm
SepCheckAndCopySelfRelativeSD