SepCreateSidValuesBlock

INT64 __fastcall SepCreateSidValuesBlock(
        _SEP_SID_VALUES_BLOCK **SidValues,
        _SID_AND_ATTRIBUTES *User,
        UINT64 GroupCount,
        _SID_AND_ATTRIBUTES *Groups,
        UINT64 GroupsLength,
        UINT64 IntegrityLevelIndexInGroups){
  unsigned int v6; 
  _SEP_SID_VALUES_BLOCK **v9; 
  unsigned int v11; 
  int v12; 
  unsigned int v13; 
  char *PoolWithTag; 
  char *v15; 
  unsigned int v16; 
  unsigned int v17; 
  unsigned __int8 *v18; 
  unsigned __int8 *Sid; 
  __int64 v20; 
  char *v21; 
  v6 = GroupCount;
  v9 = SidValues;
  if( !SidValues )
    return 3221225485i64;
  *SidValues = 0i64;
  v11 = v6;
  v12 = GroupsLength;
  if( (unsigned int)IntegrityLevelIndexInGroups < v6 )
  {
    _mm_lfence();
    v11 = v6 - 1;
    v12 = GroupsLength - 4 * *((unsigned __int8 *)Groups[(unsigned int)IntegrityLevelIndexInGroups].Sid + 1) - 8;
  }
  v13 = (((4 * *((unsigned __int8 *)User->Sid + 1) + 11) & 0xFFFFFFFC) + 27 + ((v12 + 7) & 0xFFFFFFF8)) & 0xFFFFFFFC;
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v13, 0x76536553ui64);
  v21 = PoolWithTag;
  v15 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  memset((INT64)PoolWithTag, 0i64);
  v16 = v6 + 1;
  *(_DWORD *)v15 = v13;
  v17 = 0;
  *((_QWORD *)v15 + 1) = 1i64;
  v18 = (unsigned __int8 *)(v15 + 24);
  if( !v16 )
    goto LABEL_15;
  do
  {
    if( v17 )
    {
      v20 = v17 - 1;
      if( (_DWORD)v20 == (_DWORD)IntegrityLevelIndexInGroups )
        goto LABEL_13;
      Sid = (unsigned __int8 *)Groups[v20].Sid;
    }
    else
    {
      Sid = (unsigned __int8 *)User->Sid;
    }
    RtlCopySid(4 * Sid[1] + 8, v18, Sid);
    v18 += (4i64 * v18[1] + 11) & 0xFFFFFFFCi64;
LABEL_13:
    ++v17;
  }
  while( v17 < v16 );
  v15 = v21;
  v9 = SidValues;
LABEL_15:
  *v9 = (_SEP_SID_VALUES_BLOCK *)v15;
  *((_DWORD *)v15 + 4) = v11 + 1;
  return 0i64;
}

Referenced by: