SepFlattenAcl

INT64 __fastcall SepFlattenAcl(INT64 a1, CHAR **a2, UINT64 *a3, _WORD *a4){
  unsigned int v4; 
  unsigned __int8 *v5; 
  unsigned int v6; 
  __int16 v8; 
  INT64 v9; 
  unsigned int v10; 
  __int64 v11; 
  char v12; 
  CHAR *PoolWithTag; 
  CHAR *v14; 
  CHAR *v16; 
  char v17; 
  int v18; 
  int v19; 
  v4 = *(unsigned __int16 *)(a1 + 4);
  v5 = (unsigned __int8 *)(a1 + 8);
  v6 = 0;
  *a2 = 0i64;
  v8 = 0;
  *(_DWORD *)a3 = 0;
  v9 = a1 + 8;
  v10 = 0;
  if( !(_WORD)v4 )
    return 3221226021i64;
  v11 = v4;
  do
  {
    v12 = *(_BYTE *)v9;
    v10 += 12;
    if( *(_BYTE *)v9 <= 3u || v12 == 17 || v12 == 20 || v12 == 21 )
    {
      v10 += 4 * *(unsigned __int8 *)(v9 + 9) + 8;
      ++v8;
    }
    v9 += *(unsigned __int16 *)(v9 + 2);
    --v11;
  }
  while( v11 );
  if( !v8 )
    return 3221226021i64;
  PoolWithTag = (CHAR *)ExAllocatePoolWithTag(PagedPool, v10, 0x614C6553ui64);
  v14 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225495i64;
  v16 = PoolWithTag;
  if( *(_WORD *)(a1 + 4) )
  {
    do
    {
      v17 = *v5;
      if( *v5 <= 3u || v17 == 17 || v17 == 20 || v17 == 21 )
      {
        v18 = *((_DWORD *)v5 + 1);
        *((_DWORD *)v16 + 1) = v5[1];
        v19 = *v5;
        *((_DWORD *)v16 + 2) = v18;
        *(_DWORD *)v16 = v19;
        memmove((UINT8 *)v16 + 12, v5 + 8, 4i64 * v5[9] + 8);
        v16 += 4 * v5[9] + 20;
      }
      ++v6;
      v5 += *((unsigned __int16 *)v5 + 1);
    }
    while( v6 < *(unsigned __int16 *)(a1 + 4) );
  }
  *a2 = v14;
  *(_DWORD *)a3 = v10;
  *a4 = v8;
  return 0i64;
}

Referenced by: