LookupSidInTable

_STRSD_SID_LOOKUP *__stdcall LookupSidInTable(
        WCHAR *String,
        VOID *Sid,
        VOID *RootDomainSid,
        UINT8 DefaultToDomain,
        VOID **pSASid,
        UINT8 DefaultToDomaina){
  _STRSD_SID_LOOKUP *v6; 
  int v9; 
  unsigned int v10; 
  unsigned __int8 *v11; 
  int v12; 
  int *v13; 
  int v14; 
  unsigned int v15; 
  PVOID *v16; 
  __int64 v17; 
  __int64 v19; 
  INT64 v20; 
  NTSTATUS v21; 
  UINT8 v22; 
  UINT64 v23; 
  VOID *v24; 
  unsigned __int8 *v25; 
  _DWORD *v26; 
  int v27; 
  char v29; 
  VOID **pSASida; 
  VOID **v31; 

  v6 = 0i64;
  v29 = 0;
  v27 = 0;
  if( __PAIR128__((unsigned __int64)String, (unsigned __int64)Sid) == 0 )
    return 0i64;
  v9 = 0;
  v10 = 63;
  *v31 = 0i64;
  if( !String )
  {
    v29 = 1;
    LODWORD(v11) = RtlSubAuthorityCountSid((INT64)Sid);
    v12 = *v11;
    if( !(_BYTE)v12 )
      goto LABEL_7;
    LODWORD(v13) = RtlSubAuthoritySid((INT64)Sid, (unsigned int)(v12 - 1));
    v14 = *v13;
    if( *v13 != 498 && (unsigned int)(v14 - 518) > 1 )
      goto LABEL_7;
    v9 = 1;
    if( v14 != 518 )
      goto LABEL_7;
    goto LABEL_29;
  }
  if( wcsnicmp(String, L"EA", 2u) )
  {
    if( wcsnicmp(String, L"SA", 2u) )
    {
      if( !wcsnicmp(String, L"RO", 2u) )
        v9 = 1;
      goto LABEL_7;
    }
    v9 = 1;
LABEL_29:
    v27 = 1;
    goto LABEL_7;
  }
  v9 = 1;
LABEL_7:
  v15 = 0;
  v16 = (PVOID *)&unk_140C0F420;
  do
  {
    if( v29 )
    {
      if( RtlEqualSid(Sid, *v16) )
        break;
      goto LABEL_10;
    }
    pSASida = (VOID **)((char *)&unk_140C0F410 + 104 * v15 + 2);
    if( !wcsnicmp(String, (const wchar_t *)pSASida, *((_DWORD *)v16 - 1)) )
      break;
    if( v9
      && DefaultToDomaina
      && !RootDomainSid
      && *((_BYTE *)v16 - 16)
      && *v16
      && !wcsnicmp(L"DA", (const wchar_t *)pSASida, *((_DWORD *)v16 - 1)) )
    {
      v10 = v15;
    }
LABEL_10:
    ++v15;
    v16 += 13;
  }
  while( v15 < 0x3F );
  if( v15 < 0x3F )
  {
    v17 = v15;
    return(_STRSD_SID_LOOKUP *)((char *)&unk_140C0F410 + 104 * v17);
  }
  if( v9 && DefaultToDomaina && !RootDomainSid && v10 < 0x3F )
  {
    if( v27 )
    {
      if( v29 )
      {
        *v31 = Sid;
      }
      else
      {
        v19 = 104i64 * v10;
        v20 = *(_QWORD *)((char *)&unk_140C0F410 + v19 + 16);
        if( v20 )
        {
          v21 = RtlLengthSid(v20);
          v24 = SddlpAlloc((unsigned int)(v21 + 1), v22, v23);
          *v31 = v24;
          if( v24 )
          {
            _mm_lfence();
            memmove(v24, *(const VOID **)((char *)&unk_140C0F410 + v19 + 16), v21);
            LODWORD(v25) = RtlSubAuthorityCountSid(*(_QWORD *)((char *)&unk_140C0F410 + v19 + 16));
            LODWORD(v26) = RtlSubAuthoritySid((INT64)v24, (unsigned int)*v25 - 1);
            *v26 = 518;
          }
        }
      }
    }
    else
    {
      v17 = v10;
      return(_STRSD_SID_LOOKUP *)((char *)&unk_140C0F410 + 104 * v17);
    }
  }
  return v6;
}

Referenced by: