RtlSidHashLookup

SID_AND_ATTRIBUTES *__stdcall RtlSidHashLookup(SID_AND_ATTRIBUTES_HASH *SidAttrHash, PVOID Sid){
  unsigned __int8 v4; 
  __int16 v5; 
  unsigned int v6; 
  unsigned int v7; 
  unsigned __int64 i; 
  unsigned int SidCount; 
  int v11; 
  _SID_AND_ATTRIBUTES *SidAttr; 
  int v13; 
  SID_AND_ATTRIBUTES *v14; 
  _SID_AND_ATTRIBUTES *v15; 
  unsigned int v16; 
  PVOID *p_Sid; 
  int v18; 
  _SID_AND_ATTRIBUTES *v19; 
  if( !SidAttrHash || !Sid )
    return 0i64;
  v4 = 0;
  v5 = *(_WORD *)Sid;
  v6 = 4 * *((unsigned __int8 *)Sid + 1) + 8;
  v7 = *((unsigned __int8 *)Sid + 4 * ((unsigned __int64)*(unsigned __int16 *)Sid >> 8) + 4);
  for( i = SidAttrHash->Hash[v7 & 0xF] & SidAttrHash->Hash[((unsigned __int64)v7 >> 4) + 16]; i; i >>= 8 )
  {
    LOBYTE(v11) = i;
    if( (_BYTE)i )
    {
      SidAttr = SidAttrHash->SidAttr;
      v19 = SidAttr;
      v13 = v4;
      do
      {
        v18 = *((unsigned __int8 *)SidHashByteToIndexLookupTable + (unsigned __int8)v11);
        v14 = &SidAttr[v13 + v18];
        if( *(_WORD *)v14->Sid == v5 )
        {
          if( !memcmp(Sid, v14->Sid, v6) )
            return v14;
          SidAttr = v19;
          v13 = v4;
        }
        v11 = (unsigned __int8)v11 ^ (1 << v18);
      }
      while( (_BYTE)v11 );
    }
    v4 += 8;
  }
  SidCount = SidAttrHash->SidCount;
  if( SidAttrHash->SidCount <= 0x40 )
    return 0i64;
  v15 = SidAttrHash->SidAttr;
  v16 = 64;
  while( 1 )
  {
    p_Sid = &v15[v16].Sid;
    if( *(_WORD *)*p_Sid == v5 && !memcmp(Sid, *p_Sid, v6) )
      break;
    if( ++v16 >= SidCount )
      return 0i64;
  }
  return &v15[v16];
}

Referenced by: