SepCreateClaimAttributes

__int64 __fastcall SepCreateClaimAttributes(_QWORD *a1, __int64 a2, __int64 a3, unsigned int a4, void *Src){
  int v8; 
  _DWORD *v9; 
  _DWORD *v10; 
  SID_AND_ATTRIBUTES *v11; 
  INT64 v13; 
  _DWORD *ClaimCollectionNoLists; 
  _DWORD *v15; 
  _DWORD *v16; 
  int v17; 
  SID_AND_ATTRIBUTES *PoolWithTag; 
  UINT64 CaptureBufferLength; 
  _POOL_TYPE v20; 
  UINT8 v21; 
  char v22; 
  char v23; 
  int v24; 
  SIZE_T NumberOfBytes; 
  _SID_AND_ATTRIBUTES *CapturedArray; 
  v24 = 1;
  v22 = 0;
  v23 = 0;
  LODWORD(NumberOfBytes) = 0;
  v8 = 0;
  CapturedArray = 0i64;
  v9 = 0i64;
  v10 = 0i64;
  v11 = 0i64;
  if( !a1 )
    return 3221225485i64;
  *a1 = 0i64;
  if( !a2 && !a3 && !a4 )
    return 0i64;
  ClaimCollectionNoLists = AuthzBasepAllocateClaimCollectionNoLists(0i64, a2);
  if( ClaimCollectionNoLists )
  {
    if( a2 )
    {
      AuthzBasepAllocateSecurityAttributesList(v13);
      v9 = v15;
      if( !v15 )
      {
        v8 = -1073741670;
LABEL_35:
        ExFreePoolWithTag(ClaimCollectionNoLists, 0);
        return(unsigned int)v8;
      }
      v8 = AuthzBasepSetSecurityAttributesToken(v15, &v24, a2);
      if( v8 < 0 )
        goto LABEL_25;
      v22 = 1;
      *((_QWORD *)ClaimCollectionNoLists + 72) = v9;
    }
    if( a3 )
    {
      AuthzBasepAllocateSecurityAttributesList(v13);
      v10 = v16;
      if( !v16 )
        goto LABEL_37;
      v8 = AuthzBasepSetSecurityAttributesToken(v16, &v24, a3);
      if( v8 < 0 )
        goto LABEL_25;
      v23 = 1;
      *((_QWORD *)ClaimCollectionNoLists + 73) = v10;
    }
    if( !Src || !a4 )
      goto LABEL_24;
    v8 = SepLengthSidAndAttributesArray((_SID_AND_ATTRIBUTES *)Src, a4, &NumberOfBytes);
    if( v8 < 0 )
    {
LABEL_25:
      if( v9 )
      {
        if( v22 )
          AuthzBasepFreeSecurityAttributesList(v9);
        ExFreePoolWithTag(v9, 0);
      }
      if( v10 )
      {
        if( v23 )
          AuthzBasepFreeSecurityAttributesList(v10);
        ExFreePoolWithTag(v10, 0);
      }
      if( v11 )
        ExFreePoolWithTag(v11, 0);
      goto LABEL_35;
    }
    v17 = NumberOfBytes;
    PoolWithTag = (SID_AND_ATTRIBUTES *)ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x64546553ui64);
    v11 = PoolWithTag;
    if( PoolWithTag )
    {
      LODWORD(CaptureBufferLength) = v17;
      v8 = SeCaptureSidAndAttributesArray(
             (_SID_AND_ATTRIBUTES *)Src,
             a4,
             0,
             PoolWithTag,
             CaptureBufferLength,
             v20,
             v21,
             &CapturedArray,
             &NumberOfBytes);
      if( v8 >= 0 )
      {
        *ClaimCollectionNoLists = a4;
        *((_QWORD *)ClaimCollectionNoLists + 1) = v11;
        RtlSidHashInitialize(v11, a4, (SID_AND_ATTRIBUTES_HASH *)(ClaimCollectionNoLists + 8));
LABEL_24:
        *a1 = ClaimCollectionNoLists;
        return(unsigned int)v8;
      }
      goto LABEL_25;
    }
LABEL_37:
    v8 = -1073741670;
    goto LABEL_25;
  }
  return(unsigned int)-1073741670;
}

Referenced by: