默认安全

默认安全

int __fastcall GetFileSystemDefaultSecurity(int a1, int a2)
{
  int v2; // edi@1
  int v3; // esi@2
  const wchar_t *v4; // ecx@4
  int v5; // ecx@5
  int v6; // eax@27
  int v7; // eax@27
  const char *v9; // [sp+10h] [bp-20h]@2
  const char *v10; // [sp+14h] [bp-1Ch]@2
  int v11; // [sp+18h] [bp-18h]@2
  const char *v12; // [sp+1Ch] [bp-14h]@2
  int v13; // [sp+20h] [bp-10h]@6
  int v14; // [sp+24h] [bp-Ch]@6
  int v15; // [sp+28h] [bp-8h]@1

  v15 = 0xC00000E5;
  v2 = a2;
  if ( a1 & 0xFFFFF800 )
  {
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v15);
    v9 = "base\\wcp\\library\\element_security.cpp";
    v10 = "GetFileSystemDefaultSecurity";
    v11 = 345;
    v12 = "Valid flags check failed: Flags";
    Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(&v9);
    v3 = v15;
  }
  else
  {
    v10 = 0;
    v11 = 0;
    v12 = 0;
    if ( a1 & 1 || a1 & 4 || a1 & 2 )
    {
      v4 = L"O:SYG:SYD:AIARS:AIAR";
    }
    else if ( a1 & 8 )
    {
      v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
            "53292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)"
            "(A;;GRGX;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)S:(AU;FASA;SDWDWOFW;;;WD)";
    }
    else if ( a1 & 0x10 )
    {
      v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
            "53292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)"
            "(A;;GRGX;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)S:AI";
    }
    else if ( a1 & 0x20 )
    {
      v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
            "53292631-2271478464D:AIS:AI";
    }
    else if ( a1 & 0x40 )
    {
      v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
            "53292631-2271478464D:P(A;CIOI;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;CIOI;GR"
            "GX;;;BA)(A;CIOI;GRGX;;;SY)(A;CIOI;GRGX;;;BU)(A;CIOI;GRGX;;;S-1-15-2-1)S:AI";
    }
    else if ( (char)a1 >= 0 )
    {
      if ( a1 & 0x100 )
      {
        v4 = L"O:BAG:SYD:(A;;GA;;;BA)(A;;GA;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)";
      }
      else if ( a1 & 0x200 )
      {
        v4 = L"O:SYG:SY";
      }
      else
      {
        if ( !(a1 & 0x400) )
        {
          v3 = -1073741811;
          v15 = -1073741811;
          Windows::Auto<_LUTF8_STRING>::~Auto<_LUTF8_STRING>(&v10);
          v9 = "base\\wcp\\library\\element_security.cpp";
          v10 = "GetFileSystemDefaultSecurity";
          v11 = 429;
          v12 = 0;
          Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(&v9);
          return v3;
        }
        v4 = L"O:SYG:SYD:P(A;CIOI;GA;;;SY)(A;CIOI;GRGX;;;WD)(A;CIOI;GRGX;;;S-1-15-2-1)";
      }
    }
    else
    {
      v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
            "53292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)"
            "(A;;FA;;;SY)(A;;GRGX;;;BU)(A;;0x1200a9;;;S-1-15-2-1)S:AIAR";
    }
    v3 = RtlDuplicateNullTerminatedStringToLUnicodeString(v4, &v10);
    if ( v3 >= 0 )
    {
      v13 = 0;
      v14 = 0;
      v3 = ((int (__stdcall *)(int, const char **, int *, int))Windows::WCP::Implementation::Rtl::CSecurityDescriptorFactory::ConvertStringSecurityDescriptor)(
             v5,
             &v10,
             &v13,
             v5);
      if ( v3 >= 0 )
      {
        v6 = *(_DWORD *)v2;
        *(_DWORD *)v2 = v13;
        v13 = v6;
        v7 = *(_DWORD *)(v2 + 4);
        *(_DWORD *)(v2 + 4) = v14;
        v14 = v7;
        Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetCanonicalSuccess(&v15);
        Windows::Auto<_SECURITY_DESCRIPTOR>::~Auto<_SECURITY_DESCRIPTOR>(&v13);
        Windows::Auto<_LUTF8_STRING>::~Auto<_LUTF8_STRING>(&v10);
        return v15;
      }
      Windows::Auto<_SECURITY_DESCRIPTOR>::~Auto<_SECURITY_DESCRIPTOR>(&v13);
    }
    Windows::Auto<_LUTF8_STRING>::~Auto<_LUTF8_STRING>(&v10);
  }
  return v3;
}