SepCreateSidValuesBlock

NTSTATUS __stdcall SepCreateSidValuesBlock(
        _SEP_SID_VALUES_BLOCK **SidValues,
        _SID_AND_ATTRIBUTES *User,
        UINT64 GroupCount,
        _SID_AND_ATTRIBUTES *Groups,
        UINT64 GroupsLength,
        UINT64 IntegrityLevelIndexInGroups){
  unsigned int v6; 
  _SEP_SID_VALUES_BLOCK **v9; 
  unsigned int v11; 
  int v12; 
  unsigned int v13; 
  VOID **PoolWithTag; 
  VOID **v15; 
  unsigned int v16; 
  unsigned int v17; 
  unsigned __int8 *v18; 
  unsigned __int8 *Sid; 
  __int64 v20; 
  VOID **v21; 

  v6 = GroupCount;
  v9 = SidValues;
  if( !SidValues )
    return -1073741811;
  *SidValues = 0i64;
  v11 = v6;
  v12 = GroupsLength;
  if( (unsigned int)IntegrityLevelIndexInGroups < v6 )
  {
    _mm_lfence();
    v11 = v6 - 1;
    v12 = GroupsLength - 4 * *((unsigned __int8 *)Groups[(unsigned int)IntegrityLevelIndexInGroups].Sid + 1) - 8;
  }
  v13 = (((4 * *((unsigned __int8 *)User->Sid + 1) + 11) & 0xFFFFFFFC) + 27 + ((v12 + 7) & 0xFFFFFFF8)) & 0xFFFFFFFC;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v13, 1985176915i64);
  v21 = PoolWithTag;
  v15 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memset(PoolWithTag, 0i64, v13);
  v16 = v6 + 1;
  *(_DWORD *)v15 = v13;
  v17 = 0;
  v15[1] = (VOID *)1;
  v18 = (unsigned __int8 *)(v15 + 3);
  if( !v16 )
    goto LABEL_15;
  do
  {
    if( v17 )
    {
      v20 = v17 - 1;
      if( (_DWORD)v20 == (_DWORD)IntegrityLevelIndexInGroups )
        goto LABEL_13;
      Sid = (unsigned __int8 *)Groups[v20].Sid;
    }
    else
    {
      Sid = (unsigned __int8 *)User->Sid;
    }
    RtlCopySid(4 * (unsigned int)Sid[1] + 8, v18, Sid);
    v18 += (4i64 * v18[1] + 11) & 0xFFFFFFFCi64;
LABEL_13:
    ++v17;
  }
  while( v17 < v16 );
  v15 = v21;
  v9 = SidValues;
LABEL_15:
  *v9 = (_SEP_SID_VALUES_BLOCK *)v15;
  *((_DWORD *)v15 + 4) = v11 + 1;
  return 0;
}

Referenced by: