默认安全
int __fastcall GetFileSystemDefaultSecurity(int a1, int a2)
{
int v2; // edi@1
int v3; // esi@2
const wchar_t *v4; // ecx@4
int v5; // ecx@5
int v6; // eax@27
int v7; // eax@27
const char *v9; // [sp+10h] [bp-20h]@2
const char *v10; // [sp+14h] [bp-1Ch]@2
int v11; // [sp+18h] [bp-18h]@2
const char *v12; // [sp+1Ch] [bp-14h]@2
int v13; // [sp+20h] [bp-10h]@6
int v14; // [sp+24h] [bp-Ch]@6
int v15; // [sp+28h] [bp-8h]@1
v15 = 0xC00000E5;
v2 = a2;
if ( a1 & 0xFFFFF800 )
{
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v15);
v9 = "base\\wcp\\library\\element_security.cpp";
v10 = "GetFileSystemDefaultSecurity";
v11 = 345;
v12 = "Valid flags check failed: Flags";
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(&v9);
v3 = v15;
}
else
{
v10 = 0;
v11 = 0;
v12 = 0;
if ( a1 & 1 || a1 & 4 || a1 & 2 )
{
v4 = L"O:SYG:SYD:AIARS:AIAR";
}
else if ( a1 & 8 )
{
v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
"53292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)"
"(A;;GRGX;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)S:(AU;FASA;SDWDWOFW;;;WD)";
}
else if ( a1 & 0x10 )
{
v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
"53292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)"
"(A;;GRGX;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)S:AI";
}
else if ( a1 & 0x20 )
{
v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
"53292631-2271478464D:AIS:AI";
}
else if ( a1 & 0x40 )
{
v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
"53292631-2271478464D:P(A;CIOI;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;CIOI;GR"
"GX;;;BA)(A;CIOI;GRGX;;;SY)(A;CIOI;GRGX;;;BU)(A;CIOI;GRGX;;;S-1-15-2-1)S:AI";
}
else if ( (char)a1 >= 0 )
{
if ( a1 & 0x100 )
{
v4 = L"O:BAG:SYD:(A;;GA;;;BA)(A;;GA;;;SY)(A;;GRGX;;;BU)(A;;GRGX;;;S-1-15-2-1)";
}
else if ( a1 & 0x200 )
{
v4 = L"O:SYG:SY";
}
else
{
if ( !(a1 & 0x400) )
{
v3 = -1073741811;
v15 = -1073741811;
Windows::Auto<_LUTF8_STRING>::~Auto<_LUTF8_STRING>(&v10);
v9 = "base\\wcp\\library\\element_security.cpp";
v10 = "GetFileSystemDefaultSecurity";
v11 = 429;
v12 = 0;
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(&v9);
return v3;
}
v4 = L"O:SYG:SYD:P(A;CIOI;GA;;;SY)(A;CIOI;GRGX;;;WD)(A;CIOI;GRGX;;;S-1-15-2-1)";
}
}
else
{
v4 = L"O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-18"
"53292631-2271478464D:P(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;GRGX;;;BA)"
"(A;;FA;;;SY)(A;;GRGX;;;BU)(A;;0x1200a9;;;S-1-15-2-1)S:AIAR";
}
v3 = RtlDuplicateNullTerminatedStringToLUnicodeString(v4, &v10);
if ( v3 >= 0 )
{
v13 = 0;
v14 = 0;
v3 = ((int (__stdcall *)(int, const char **, int *, int))Windows::WCP::Implementation::Rtl::CSecurityDescriptorFactory::ConvertStringSecurityDescriptor)(
v5,
&v10,
&v13,
v5);
if ( v3 >= 0 )
{
v6 = *(_DWORD *)v2;
*(_DWORD *)v2 = v13;
v13 = v6;
v7 = *(_DWORD *)(v2 + 4);
*(_DWORD *)(v2 + 4) = v14;
v14 = v7;
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetCanonicalSuccess(&v15);
Windows::Auto<_SECURITY_DESCRIPTOR>::~Auto<_SECURITY_DESCRIPTOR>(&v13);
Windows::Auto<_LUTF8_STRING>::~Auto<_LUTF8_STRING>(&v10);
return v15;
}
Windows::Auto<_SECURITY_DESCRIPTOR>::~Auto<_SECURITY_DESCRIPTOR>(&v13);
}
Windows::Auto<_LUTF8_STRING>::~Auto<_LUTF8_STRING>(&v10);
}
return v3;
}