SepAdjustGroups

INT64 __fastcall SepAdjustGroups(
        _TOKEN *Token,
        INT64 MakeChanges,
        INT64 ResetToDefault,
        UINT64 GroupCount,
        _SID_AND_ATTRIBUTES *NewState,
        _TOKEN_GROUPS *PreviousState,
        void *SidBuffer,
        UINT *ReturnLength,
        UINT *ChangeCount,
        UINT8 *ChangesMade){
  unsigned int v11; 
  unsigned int v12; 
  char v14; 
  int v15; 
  UINT8 v16; 
  unsigned int v17; 
  __int64 v18; 
  _SID_AND_ATTRIBUTES *UserAndGroups; 
  __int64 v20; 
  char v21; 
  void *Sid; 
  unsigned int *p_Attributes; 
  _SID_AND_ATTRIBUTES *v25; 
  unsigned int Attributes; 
  unsigned int v27; 
  int v28; 
  unsigned int v29; 
  unsigned int v30; 
  unsigned int v31; 
  unsigned int v32; 
  unsigned int v33; 
  int v34; 
  _SID_AND_ATTRIBUTES Sid1; 
  int v36; 
  char v37; 
  char v38; 
  unsigned int v39; 
  char ChangeCounta; 
  v39 = GroupCount;
  v38 = ResetToDefault;
  v37 = MakeChanges;
  v11 = 0;
  v12 = 0;
  v32 = 0;
  v14 = MakeChanges;
  v15 = 0;
  *ChangeCount = 0;
  v16 = 1;
  v36 = 0;
  v17 = 1;
  v34 = 1;
  if( Token->UserAndGroupCount <= 1 )
    goto LABEL_11;
  do
  {
    v18 = v17;
    UserAndGroups = Token->UserAndGroups;
    v20 = v18;
    Sid1 = UserAndGroups[v20];
    if( !(_BYTE)ResetToDefault )
    {
      v33 = 0;
      v21 = 0;
      ChangeCounta = 0;
      if( !(_DWORD)GroupCount )
        goto LABEL_9;
      Sid = UserAndGroups[v20].Sid;
      p_Attributes = &NewState->Attributes;
      while( !v21 )
      {
        if( RtlEqualSid(Sid, *((PVOID *)p_Attributes - 1)) )
        {
          v25 = Token->UserAndGroups;
          ++v32;
          ChangeCounta = 1;
          Attributes = v25[v20].Attributes;
          if( ((*(_BYTE *)p_Attributes ^ LOBYTE(v25[v20].Attributes)) & 4) != 0 )
          {
            if( (Attributes & 1) != 0 )
              return 3221225565i64;
            if( (Attributes & 0x10) != 0 )
              return 3221226163i64;
            v27 = (4 * *((unsigned __int8 *)Sid1.Sid + 1) + 11) & 0xFFFFFFFC;
            v36 += v27;
            if( v37 )
            {
              if( PreviousState )
              {
                PreviousState->Groups[*ChangeCount].Attributes = Sid1.Attributes;
                PreviousState->Groups[*ChangeCount].Sid = SidBuffer;
                RtlCopySid(v27, SidBuffer, Sid1.Sid);
                v25 = Token->UserAndGroups;
                SidBuffer = (char *)SidBuffer + v27;
              }
              v25[v20].Attributes &= ~(v25[v20].Attributes & 4);
              Token->UserAndGroups[v20].Attributes |= *p_Attributes & 4;
            }
            ++*ChangeCount;
            Sid = Sid1.Sid;
          }
        }
        p_Attributes += 4;
        LODWORD(GroupCount) = v39;
        ++v33;
        v21 = ChangeCounta;
        if( v33 >= v39 )
          goto LABEL_8;
      }
      goto LABEL_8;
    }
    v28 = UserAndGroups[v20].Attributes & 6;
    if( ((v28 - 2) & 0xFFFFFFFD) == 0 )
    {
      v29 = (4 * *((unsigned __int8 *)Sid1.Sid + 1) + 11) & 0xFFFFFFFC;
      v36 = v29 + v15;
      if( v14 )
      {
        if( PreviousState )
        {
          PreviousState->Groups[*ChangeCount].Attributes = Sid1.Attributes;
          PreviousState->Groups[*ChangeCount].Sid = SidBuffer;
          RtlCopySid(v29, SidBuffer, Sid1.Sid);
          UserAndGroups = Token->UserAndGroups;
          LODWORD(GroupCount) = v39;
          SidBuffer = (char *)SidBuffer + v29;
        }
        v30 = UserAndGroups[v20].Attributes;
        if( v28 == 2 )
          v31 = v30 | 4;
        else
          v31 = v30 & 0xFFFFFFFB;
        UserAndGroups[v20].Attributes = v31;
      }
      ++*ChangeCount;
LABEL_8:
      LOBYTE(ResetToDefault) = v38;
    }
LABEL_9:
    v15 = v36;
    v17 = v34 + 1;
    v14 = v37;
    v34 = v17;
  }
  while( v17 < Token->UserAndGroupCount );
  v11 = v32;
LABEL_11:
  if( !(_BYTE)ResetToDefault && v11 < (unsigned int)GroupCount )
    v12 = 262;
  if( !*ChangeCount || !v14 )
    v16 = 0;
  *ChangesMade = v16;
  if( PreviousState )
    *ReturnLength = 16 * *ChangeCount + 8 + v15;
  return v12;
}

Referenced by: