RtlFindAceBySid

VOID *__stdcall RtlFindAceBySid(_ACL *pAcl, VOID *pSid, UINT64 *pIndex){
  unsigned int AceCount; 
  _ACL *v6; 
  unsigned int v7; 
  int v8; 
  unsigned int AclRevision; 
  __int64 v10; 
  unsigned __int16 *v11; 
  unsigned __int64 v12; 

  if( !pAcl )
    return 0i64;
  AceCount = pAcl->AceCount;
  v6 = pAcl + 1;
  v7 = 0;
  if( !pAcl->AceCount )
    return 0i64;
  v8 = 4089359;
  while( 1 )
  {
    AclRevision = v6->AclRevision;
    if( (unsigned __int8)AclRevision <= 0x15u && _bittest(&v8, AclRevision) )
    {
      v10 = 8i64;
    }
    else if( (_BYTE)AclRevision == 4 )
    {
      v10 = 12i64;
    }
    else
    {
      if( (unsigned __int8)(AclRevision - 5) > 3u
        && (unsigned __int8)(AclRevision - 11) > 1u
        && (unsigned __int8)(AclRevision - 15) > 1u )
      {
        goto LABEL_10;
      }
      v10 = 16i64 * (*(_DWORD *)&v6[1].AclRevision & 1) + ((8i64 * (*(_DWORD *)&v6[1].AclRevision & 2)) | 0xC);
    }
    v11 = (unsigned __int16 *)((char *)v6 + v10);
    if( v11 )
      break;
LABEL_10:
    ++v7;
    v6 = (_ACL *)((char *)v6 + v6->AclSize);
    if( v7 >= AceCount )
      return 0i64;
  }
  if( !pIndex )
  {
    v12 = *v11;
    if( (_WORD)v12 == *(_WORD *)pSid && !memcmp(v11, pSid, 4 * (v12 >> 8) + 8) )
      return v6;
    goto LABEL_10;
  }
  if( v7 < *(_DWORD *)pIndex || !RtlEqualSid(v11, pSid) )
    goto LABEL_10;
  *(_DWORD *)pIndex = v7;
  return v6;
}

Referenced by: