SeQueryMandatoryLabel

UINT64 __stdcall SeQueryMandatoryLabel(VOID *SecurityDescriptor){
  __int16 v1; 
  unsigned int v2; 
  __int64 v3; 
  _ACL *v4; 
  INT64 v5; 
  _BYTE *AceByType; 
  unsigned __int8 *v7; 
  int v8; 
  unsigned int *v9; 
  UINT64 pIndex; 

  v1 = *((_WORD *)SecurityDescriptor + 1);
  v2 = 0;
  if( (v1 & 0x10) == 0 )
    goto LABEL_11;
  if( v1 >= 0 )
  {
    v4 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
    goto LABEL_5;
  }
  v3 = *((unsigned int *)SecurityDescriptor + 3);
  if( (_DWORD)v3 )
    v4 = (_ACL *)((char *)SecurityDescriptor + v3);
  else
LABEL_11:
    v4 = 0i64;
LABEL_5:
  v5 = SepDefaultMandatorySid;
  LODWORD(pIndex) = 0;
  while( 1 )
  {
    AceByType = RtlFindAceByType(v4, 0x11ui64, &pIndex);
    if( AceByType )
    {
      if( (AceByType[1] & 8) == 0 )
        break;
    }
    LODWORD(pIndex) = pIndex + 1;
    if( !AceByType )
      goto LABEL_8;
  }
  v5 = (INT64)(AceByType + 8);
LABEL_8:
  LODWORD(v7) = RtlSubAuthorityCountSid(v5);
  v8 = *v7;
  if( (_BYTE)v8 )
  {
    LODWORD(v9) = RtlSubAuthoritySid(v5, (unsigned int)(v8 - 1));
    return *v9;
  }
  return v2;
}

Referenced by: