RtlReplaceSidInSd

INT64 __fastcall RtlReplaceSidInSd(VOID *SecurityDescriptor, VOID *OldSid, VOID *NewSid, UINT64 *NumChanges){
  void *v4; 
  unsigned int v8; 
  INT64 result; 
  int v10; 
  int v11; 
  int v12; 
  UINT8 *v13; 
  int v14; 
  int v15; 
  int v16; 
  UINT8 *v17; 
  __int64 v18; 
  unsigned __int8 *v19; 
  __int64 v20; 
  int v21; 
  int v22; 
  int v23; 
  unsigned int v24; 
  UINT8 *v25; 
  __int64 v26; 
  unsigned __int8 *v27; 
  __int64 v28; 
  int v29; 
  int v30; 
  int v31; 
  unsigned int v32; 
  UINT8 *v33; 
  unsigned __int8 OwnerDefaulted[4]; 
  unsigned int v35; 
  PSID Owner; 
  unsigned __int8 DaclPresent; 
  *(_DWORD *)NumChanges = 0;
  v4 = SecurityDescriptor;
  DaclPresent = 0;
  Owner = 0i64;
  v8 = 4 * *RtlSubAuthorityCountSid(OldSid);
  v35 = v8;
  LODWORD(result) = RtlGetOwnerSecurityDescriptor(v4, &Owner, OwnerDefaulted);
  if( (int)result >= 0 )
  {
    if( Owner )
    {
      if( *(_BYTE *)Owner == *(_BYTE *)OldSid )
      {
        v10 = *((unsigned __int8 *)Owner + 1);
        v11 = *((unsigned __int8 *)OldSid + 1);
        if( (_BYTE)v10 == (_BYTE)v11 || v10 == v11 + 1 )
        {
          v12 = *(_DWORD *)((char *)Owner + 2) - *(_DWORD *)((char *)OldSid + 2);
          if( !v12 )
            v12 = *((unsigned __int16 *)Owner + 3) - *((unsigned __int16 *)OldSid + 3);
          if( !v12 )
          {
            v13 = (UINT8 *)Owner + 8;
            if( !memcmp((char *)Owner + 8, (char *)OldSid + 8, v8) )
            {
              memmove(v13, (UINT8 *)NewSid + 8, v8);
              ++*(_DWORD *)NumChanges;
            }
          }
        }
      }
    }
    Owner = 0i64;
    result = RtlGetGroupSecurityDescriptor(v4, &Owner, OwnerDefaulted);
    if( (int)result >= 0 )
    {
      if( Owner )
      {
        if( *(_BYTE *)Owner == *(_BYTE *)OldSid )
        {
          v14 = *((unsigned __int8 *)Owner + 1);
          v15 = *((unsigned __int8 *)OldSid + 1);
          if( (_BYTE)v14 == (_BYTE)v15 || v14 == v15 + 1 )
          {
            v16 = *(_DWORD *)((char *)Owner + 2) - *(_DWORD *)((char *)OldSid + 2);
            if( !v16 )
              v16 = *((unsigned __int16 *)Owner + 3) - *((unsigned __int16 *)OldSid + 3);
            if( !v16 )
            {
              v17 = (UINT8 *)Owner + 8;
              if( !memcmp((char *)Owner + 8, (char *)OldSid + 8, v8) )
              {
                memmove(v17, (UINT8 *)NewSid + 8, v8);
                ++*(_DWORD *)NumChanges;
              }
            }
          }
        }
      }
      Owner = 0i64;
      LODWORD(result) = RtlGetDaclSecurityDescriptor(v4, &DaclPresent, (ACL **)&Owner, OwnerDefaulted);
      if( (int)result >= 0 )
      {
        if( DaclPresent )
        {
          if( Owner )
          {
            v18 = *((unsigned __int16 *)Owner + 2);
            v19 = (unsigned __int8 *)Owner + 8;
            if( *((_WORD *)Owner + 2) )
            {
              while( *v19 > 3u )
              {
                if( *v19 == 4 )
                {
                  v20 = (__int64)&v19[(unsigned int)RtlLengthSid(v19 + 12) + 12];
                  goto LABEL_29;
                }
LABEL_38:
                v19 += *((unsigned __int16 *)v19 + 1);
                if( !--v18 )
                {
                  v4 = SecurityDescriptor;
                  goto LABEL_40;
                }
              }
              v20 = (__int64)(v19 + 8);
LABEL_29:
              if( *(_BYTE *)v20 == *(_BYTE *)OldSid )
              {
                v21 = *(unsigned __int8 *)(v20 + 1);
                v22 = *((unsigned __int8 *)OldSid + 1);
                if( (_BYTE)v21 == (_BYTE)v22 || v21 == v22 + 1 )
                {
                  v23 = *(_DWORD *)(v20 + 2) - *(_DWORD *)((char *)OldSid + 2);
                  if( !v23 )
                    v23 = *(unsigned __int16 *)(v20 + 6) - *((unsigned __int16 *)OldSid + 3);
                  if( !v23 )
                  {
                    v24 = v8;
                    v25 = (UINT8 *)(v20 + 8);
                    if( !memcmp((PVOID)(v20 + 8), (char *)OldSid + 8, v24) )
                    {
                      memmove(v25, (UINT8 *)NewSid + 8, v24);
                      ++*(_DWORD *)NumChanges;
                    }
                    v8 = v35;
                  }
                }
              }
              goto LABEL_38;
            }
          }
        }
LABEL_40:
        Owner = 0i64;
        result = RtlGetSaclSecurityDescriptor(v4, &DaclPresent, (_ACL **)&Owner, OwnerDefaulted);
        if( (int)result >= 0 && DaclPresent && Owner )
        {
          v26 = *((unsigned __int16 *)Owner + 2);
          v27 = (unsigned __int8 *)Owner + 8;
          if( *((_WORD *)Owner + 2) )
          {
            while( *v27 > 3u )
            {
              if( *v27 == 4 )
              {
                v28 = (__int64)&v27[(unsigned int)RtlLengthSid(v27 + 12) + 12];
                goto LABEL_48;
              }
LABEL_56:
              v8 = v35;
              v27 += *((unsigned __int16 *)v27 + 1);
              if( !--v26 )
                return 0i64;
            }
            v28 = (__int64)(v27 + 8);
LABEL_48:
            if( *(_BYTE *)v28 == *(_BYTE *)OldSid )
            {
              v29 = *(unsigned __int8 *)(v28 + 1);
              v30 = *((unsigned __int8 *)OldSid + 1);
              if( (_BYTE)v29 == (_BYTE)v30 || v29 == v30 + 1 )
              {
                v31 = *(_DWORD *)(v28 + 2) - *(_DWORD *)((char *)OldSid + 2);
                if( !v31 )
                  v31 = *(unsigned __int16 *)(v28 + 6) - *((unsigned __int16 *)OldSid + 3);
                if( !v31 )
                {
                  v32 = v8;
                  v33 = (UINT8 *)(v28 + 8);
                  if( !memcmp((PVOID)(v28 + 8), (char *)OldSid + 8, v32) )
                  {
                    memmove(v33, (UINT8 *)NewSid + 8, v32);
                    ++*(_DWORD *)NumChanges;
                  }
                }
              }
            }
            goto LABEL_56;
          }
          return 0i64;
        }
      }
    }
  }
  return result;
}

Referenced by: