SeQueryMandatoryLabel

UINT64 __stdcall SeQueryMandatoryLabel(PVOID SecurityDescriptor){
  __int16 v1; 
  unsigned int v2; 
  __int64 v3; 
  ACL *v4; 
  PSID v5; 
  __int64 v6; 
  int v7; 
  UINT64 pIndex; 
  v1 = *((_WORD *)SecurityDescriptor + 1);
  v2 = 0;
  if( (v1 & 0x10) == 0 )
    goto LABEL_11;
  if( v1 >= 0 )
  {
    v4 = (ACL *)*((_QWORD *)SecurityDescriptor + 3);
    goto LABEL_5;
  }
  v3 = *((unsigned int *)SecurityDescriptor + 3);
  if( (_DWORD)v3 )
    v4 = (ACL *)((char *)SecurityDescriptor + v3);
  else
LABEL_11:
    v4 = 0i64;
LABEL_5:
  v5 = SepDefaultMandatorySid;
  LODWORD(pIndex) = 0;
  while( 1 )
  {
    LODWORD(v6) = RtlFindAceByType(v4, 0x11ui64, &pIndex);
    if( v6 )
    {
      if( (*(_BYTE *)(v6 + 1) & 8) == 0 )
        break;
    }
    LODWORD(pIndex) = pIndex + 1;
    if( !v6 )
      goto LABEL_8;
  }
  v5 = (PSID)(v6 + 8);
LABEL_8:
  v7 = *RtlSubAuthorityCountSid(v5);
  if( (_BYTE)v7 )
    return *RtlSubAuthoritySid(v5, (unsigned int)(v7 - 1));
  return v2;
}

Referenced by: